johnng007/live-forensicatorCross-platform incident response and live forensic artifact collector with built-in detection, structured analysis, and report generation — designed for fast, actionable security investigations.
Collects forensic artifacts from live systems for analysis in Forensicator Core. Includes a built-in HTML report for quick triage and preliminary findings review.
Live Forensicator is a cross-platform forensic artifact collector.
It is designed to help forensic investigators and incident responders rapidly collect system and user activity artifacts from a live host or device. The collected artifacts can be uploaded to Forensicator Core for analysis. The collector also bundles a built-in HTML report for quick triage along the way.
Live Forensicator:
The collector gathers the evidence; Forensicator Core is where it gets analyzed. Core is the free, self-hosted DFIR platform that parses what this collector produces into structured, searchable findings, then enriches, correlates, and reports on them.
With Core you can:
-WINARTIFACTS: registry hives with their transaction logs, Prefetch, $MFT/$UsnJrnl/$LogFile, SRUM, Windows Search, Defender quarantine, WER, BITS, WMI subscriptions, OneDrive logs, and more.-A: accounts, sudoers, shell histories, SSH keys, cron, systemd or launch items, login items, code signatures, TCC privacy grants, downloads, FSEvents, processes and a filesystem timeline — with their logs sent to Log Analysis in the same case..evtx or the collector's Event XML channel exports).Core runs with Docker or on a Linux machine or VM:
git clone https://github.com/Raptormatics/Forensicator-Core forensicator-core
cd forensicator-core
cp .env.docker.example .env # set NEXTAUTH_SECRET
docker compose up -d # then open http://localhost:3000
👉 https://github.com/Raptormatics/Forensicator-Core
ℹ️ Core is source-available under the Business Source License 1.1. Each version converts to Apache 2.0 on its Change Date. See the Core repository's README for installation options and license details.
-WINARTIFACTS, opt-in) — raw Shimcache/Amcache/Prefetch/UserAssist/BAM/Autoruns/LNK/Jump List/Shellbag/$MFT/$UsnJrnl/SRUM/Defender quarantine/WER/Windows Search database/Recycle Bin/Notifications/BITS/Windows Timeline artifacts, plus each registry hive's own .LOG1/.LOG2 transaction logs for Forensicator Core to replay into a more complete hive — all via a Volume Shadow Copy snapshot to reach locked registry hives, $MFT, $UsnJrnl:$J, SRUDB.dat, Windows.edb, wpndatabase.db, and ActivitiesCache.dbconfig.json: sigma.enabled — off by default, since it's a real-time scan with meaningful runtime/log-query cost) evaluated against Security/Sysmon Event Logs, known-Event-ID detection, and malware hash matching (e.g., abuse.ch feeds)👉 https://github.com/Johnng007/Live-Forensicator/tree/main/Windows
-A, opt-in) — Directory Services account records, launch items, login and background items, code signatures of running and persistent programs, TCC privacy databases, quarantine events (downloads), KnowledgeC, install history, XProtect detections, FSEvents, histories, a process table, unified log exports and a filesystem timeline, with a SHA-256 manifest👉 https://github.com/Johnng007/Live-Forensicator/tree/main/MacOS
⚠️ Note: macOS restricts real process-creation telemetry to its Endpoint Security Framework, which a plain script cannot access — so Sigma coverage is narrower here than on Windows/Linux. See the macOS README for specifics.
-A, opt-in) — accounts, sudoers, PAM, login records, every user's histories and SSH files, cron/at, systemd and other persistence, logs with their rotations, a journal export, the process table (deleted executables recovered), sockets, packages, containers and a filesystem timeline, with a SHA-256 manifest👉 https://github.com/Johnng007/Live-Forensicator/tree/main/Linux