The artifactcollector project provides a software that collects forensic artifacts on systems. These artifacts can be used in forensic investigations to understand attacker behavior on compromised computers.

The artifactcollector offers the following features

• ️🖥️ Runs on 🖼️ Windows, 🐧 Linux and 🍏 macOS
• 🛍️ Can extract files, directories, registry entries, command and WMI output.
• ⭐ Uses the configurable and extensible Forensics Artifacts
• 💾 Creates structured output
• ‍💻 Can run without admin/root rights
• 🕊️ It's open source

Download from https://github.com/forensicanalysis/artifactcollector/releases or

git clone https://github.com/forensicanalysis/artifactcollector
cd artifactcollector
go install .

1. Clone the repository: git clone https://github.com/forensicanalysis/artifactcollector.
2. Add and edit artifact definitions as needed in pack/artifacts.
3. Edit pack/ac.yaml and add the artifacts you want to collect.
4. Run go generate. This might yield some errors or problems in your artifacts.
5. On windows you can move the syso into the root folder (e.g. cp resources\artifactcollector.syso .) to enable the icon for the executable and the UAC popup.
6. Run go build . to generates an executable.

For feedback, questions and discussions you can use the Open Source DFIR Slack.

The development of this software was partially sponsored by Siemens CERT, but is not an official Siemens product.