The artifactcollector project provides a software that collects forensic artifacts on systems. These artifacts can be used in forensic investigations to understand attacker behavior on compromised computers.
The artifactcollector offers the following features
- ๏ธ๐ฅ๏ธ Runs on ๐ผ๏ธ Windows, ๐ง Linux and ๐ macOS
- ๐๏ธ Can extract files, directories, registry entries, command and WMI output.
- โญ Uses the configurable and extensible Forensics Artifacts
- ๐พ Creates structured output
- โ๐ป Can run without admin/root rights
- ๐๏ธ It's open source
Download from https://github.com/forensicanalysis/artifactcollector/releases or
git clone https://github.com/forensicanalysis/artifactcollector
cd artifactcollector
go install .
- Clone the repository:
git clone https://github.com/forensicanalysis/artifactcollector
. - Add and edit artifact definitions as needed in
pack/artifacts
. - Edit
pack/ac.yaml
and add the artifacts you want to collect. - Run
go generate
. This might yield some errors or problems in your artifacts. - On windows you can move the syso into the root folder (e.g.
cp resources\artifactcollector.syso .
) to enable the icon for the executable and the UAC popup. - Run
go build .
to generates an executable.
For feedback, questions and discussions you can use the Open Source DFIR Slack.
The development of this software was partially sponsored by Siemens CERT, but is not an official Siemens product.