Collects forensic artifacts from live systems for analysis in Forensicator Core. Includes a built-in HTML report for quick triage and preliminary findings review.
Live Forensicator is a cross-platform forensic artifact collector.
It is designed to help forensic investigators and incident responders rapidly collect system and user activity artifacts from a live host or device. The collected artifacts can be uploaded to Forensicator Core for analysis. The collector also bundles a built-in HTML report for quick triage along the way.
Live Forensicator:
- Collects system and user activity artifacts, ready for Forensicator Core upload
- Generates structured, investigation-ready HTML reports
- Performs built-in triage — detects anomalous behavior and suspicious indicators, and highlights potential compromise or misconfiguration, on the spot
The collector gathers the evidence; Forensicator Core is where it gets analyzed. Core is the free, self-hosted DFIR platform that parses what this collector produces into structured, searchable findings, then enriches, correlates, and reports on them.
With Core you can:
- Upload a whole Windows host folder in one step. Core routes each file to its parser and verifies its SHA-256 against the collector's CollectionManifest.
- Parse the raw Windows artifacts collected with
-WINARTIFACTS: registry hives with their transaction logs, Prefetch, $MFT/$UsnJrnl/$LogFile, SRUM, Windows Search, Defender quarantine, WER, BITS, WMI subscriptions, OneDrive logs, and more. - Analyze RAM captures (Volatility3), network captures (PCAP), and event logs (raw
.evtxor the collector's Event XML channel exports). - Enrich IOCs automatically against VirusTotal, AbuseIPDB, OTX, URLhaus, ThreatFox, and MalwareBazaar.
- Group investigations and hosts under Cases, correlate findings across uploads, and produce executive and technical reports.
Core runs with Docker or on a Linux machine or VM:
git clone https://github.com/Raptormatics/Forensicator-Core forensicator-core
cd forensicator-core
cp .env.docker.example .env # set NEXTAUTH_SECRET
docker compose up -d # then open http://localhost:3000👉 https://github.com/Raptormatics/Forensicator-Core
ℹ️ Core is source-available under the Business Source License 1.1. Each version converts to Apache 2.0 on its Change Date. See the Core repository's README for installation options and license details.
- Windows Artifact Analysis collection (opt-in) — raw Shimcache/Amcache/Prefetch/UserAssist/BAM/Autoruns/LNK/Jump List/Shellbag/$MFT/$UsnJrnl/SRUM/Defender quarantine/WER/Windows Search database/Recycle Bin/Notifications/BITS/Windows Timeline artifacts, plus each registry hive's own
.LOG1/.LOG2transaction logs for Forensicator Core to replay into a more complete hive — all via a Volume Shadow Copy snapshot to reach locked registry hives, $MFT, $UsnJrnl:$J, SRUDB.dat, Windows.edb, wpndatabase.db, and ActivitiesCache.db - Advanced Event Log collection — System/Security/Application as raw .evtx, plus a configurable, richer channel list (Sysmon, Defender Operational, PowerShell, TaskScheduler, WMI-Activity, BITS-Client, RDP, etc.) exported as Core-ready single-line Event XML for Forensicator-Core's Log Analysis feature
- Windows Defender tamper-protection state and current exclusion configuration, captured as standalone findings
- Browser history extraction with IOC matching
- Investigation archive + structured JSON output for Forensicator Core
- Optional artifact encryption (AES)
- Built-in triage: Sigma rule engine (1,400+ community rules, opt-in via
config.json:sigma.enabled— off by default, since it's a real-time scan with meaningful runtime/log-query cost) evaluated against Security/Sysmon Event Logs, known-Event-ID detection, and malware hash matching (e.g., abuse.ch feeds) - Detection Insight - a summary of the detection, why it matters, the detection logic, what to look for, and its MITRE mapping
- Forensicator AI — optional, per-finding AI verdicts from a local (Ollama) or commercial LLM, shown in the report's tooltip
👉 https://github.com/Johnng007/Live-Forensicator/tree/main/Windows
- Collection of key forensic artifacts (system, user, network, process, file), FileVault/SIP/Gatekeeper/TCC/Signed System Volume integrity state, and browser history
- Investigation archive + structured JSON output for Forensicator Core
- Optional artifact encryption (AES)
- Built-in triage: detection engine covering reverse shells, SIP/Gatekeeper/kext tampering, PATH hijacking, deleted-binary execution, credential timestomping, and more
- Best-effort Sigma rule engine sourced from real SigmaHQ community rules, evaluated against the unified log
- Malware hash matching and browser history IOC matching, with auto-updating abuse.ch/URLhaus feeds
- Application code-signature verification
👉 https://github.com/Johnng007/Live-Forensicator/tree/main/MacOS
⚠️ Note: macOS restricts real process-creation telemetry to its Endpoint Security Framework, which a plain script cannot access — so Sigma coverage is narrower here than on Windows/Linux. See the macOS README for specifics.
- Cross-distro compatible Bash scripts, no non-native dependencies
- LUKS disk-encryption status and credential-file tampering timeline collection
- Structured JSON output for Forensicator Core
- Optional artifact encryption (AES)
- Built-in triage: detection engine covering reverse shells, timestomping, PATH hijacking, deleted-binary execution, package integrity, and more
- Sigma rule engine sourced from real SigmaHQ community rules, evaluated against auditd and journald where available
- Malware hash matching and malicious URL matching, with auto-updating abuse.ch/URLhaus feeds
👉 https://github.com/Johnng007/Live-Forensicator/tree/main/Linux
⚠️ Note: Linux scripts are designed to avoid non-native utilities (e.g.,net-tools) for maximum compatibility. Sigma coverage depends on whetherauditdis already configured on the target box — see the Linux README.
- SSH-based collection via Netmiko — Cisco IOS/IOS-XE, Cisco NX-OS, Arista EOS, Juniper Junos, and VyOS
- Read-only by design — every collected command is non-mutating; no configuration changes are ever made to a device
- Per-device error isolation and concurrent multi-device collection — one unreachable device never aborts the rest of the run
- Self-contained HTML report per device
- Optional AES-256-CBC artifact encryption
- Config-driven baselines — device inventory, per-rule toggles, and every rule's expected-value baseline are set in
config.json, no code changes needed to tune a deployment - Built-in triage: 21 detection rules covering unauthorized local accounts, insecure management plane (Telnet/weak SNMP/missing AAA), logic-implant persistence (EEM applets, task schedulers), boot-image and config-section tampering, NTP/syslog tampering, brute-force login patterns, unexpected SPAN sessions and tunnel interfaces, loosened ACLs, and device-to-C2 and transit-traffic-to-known-malicious-IP detection
- Detection Insight on every finding — plain-language explanation, MITRE ATT&CK mapping, and recommendations, same knowledge-base pattern as the Windows collector
- Optional Forensicator AI per-finding verdicts (Ollama/OpenAI/Azure OpenAI/Anthropic)
👉 https://github.com/Johnng007/Live-Forensicator/tree/main/Network
⚠️ Note: Talks to network infrastructure over SSH rather than running on the host being investigated — needs a reachable device. See the Network README for exact per-vendor command/rule coverage.
- Cross-platform forensic artifact collection — Windows, Linux, macOS, and (over SSH) network infrastructure
- Structured HTML reporting (with dashboards)
- Optional artifact encryption (Windows, Linux, macOS, and Network Devices)
- Built-in triage on every platform — detection of suspicious activity and anomalies as artifacts are collected, not just after the fact
- Event Log analysis (Windows)
- Sigma rule integration on the three host platforms — coverage and data source vary by OS; see each platform's section below and its own README. Network Devices uses its own declarative rule engine instead (Sigma's process/event-log model doesn't apply to network-device config auditing) — see its README's Detection Rules section
- Malware hash and IOC matching, with auto-updating threat-intel feeds (host platforms); IP/CIDR threat-intel blocklist matching against device session tables (Network Devices)
- Detection Insight with Mitre Mapping
- Forensicator AI — optional, per-finding AI verdicts from a local (Ollama) or commercial LLM (Windows and Network Devices now; Linux/macOS planned)
Forensicator generates:
- Clean, structured HTML report
- Indexed findings for easy navigation
- Extracted artifacts stored locally
- Detection insight into each finding.
- Suspicious activity statistics with Sigma Rules.
This enables fast transition from data collection → investigation → decision-making.
- Run scripts with elevated/privileged permissions for best results
- Activity may trigger IDS/IPS alerts — this is expected behavior
- External threat intelligence (hashes, IOCs) may be updated during execution
- Configuration can be customized via
config.json
Forensicator supports optional encryption of collected artifacts using AES.
This is useful when:
- Evidence must be transported securely
- Chain-of-custody concerns exist
- Legal integrity of artifacts must be preserved
⚠️ Available on Windows, Linux, macOS, and Network Devices⚠️ Not backward compatible prior to v4.1.1
Off by default. When enabled, each finding is sent to a local or commercial LLM as it's collected, and gets a real, plain-language verdict shown right in the report's tooltip.
Quick setup (local LLM via Ollama), currently Windows and Network Devices:
# 1. Install Ollama (https://ollama.com) and pull a model
ollama pull mistral:7b-instructPrefer a commercial API instead (OpenAI, Anthropic, Azure OpenAI, or any OpenAI-compatible endpoint)? Set provider accordingly and add your api_key.
📘 Full setup guide (all providers, tuning, troubleshooting): docs.forensicator.io
On top of collection, Forensicator identifies suspicious activity on the spot through:
- Event Log analysis
- Sigma-based detections
- Malicious hash matching
- IOC-based URL analysis (browser history)
- Network-device configuration auditing (21 rules) — unauthorized accounts, insecure management plane, persistence mechanisms, config tampering/drift, and known-malicious-IP matching against device session tables
Terminal Output
HTML Dashboard
Terminal Output with Forensicator AI
AI Analysis
Full changelog: 👉 https://docs.forensicator.io/changelog/
Windows: v4.3.0 (October 2026)
- NEW: Windows Artifact Analysis collection (-WINARTIFACTS, opt-in) — collects the raw Shimcache/Amcache (SYSTEM hive, Amcache.hve), Prefetch (.pf), UserAssist/BAM (NTUSER.DAT), Registry Autoruns (SYSTEM/SOFTWARE), and LNK/Jump List/Shellbag (.lnk, .automaticDestinations-ms/.customDestinations-ms, UsrClass.dat) artifacts Forensicator's Windows Artifact Analysis feature parses server-side. Locked hives are read via a Volume Shadow Copy snapshot (created and removed automatically), falling back to reg.exe save for whatever's loaded if VSS isn't available.
- NEW: -WINARTIFACTS also collects $MFT and the $UsnJrnl:$J alternate data stream (plus its raw fsutil usn queryjournal metadata) and SRUDB.dat (the SRUM/System Resource Usage Monitor ESE database), along with the HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SRUM\Extensions registry data needed to interpret it — all raw files/streams for offline analysis, not parsed by this script. $MFT, $UsnJrnl:$J, and SRUDB.dat are read via the same VSS snapshot as the locked registry hives; the journal metadata and SRUM registry data are read live and collected regardless of VSS.
- NEW: -WINARTIFACTS also collects Windows Defender quarantine files (Entries/ResourceData, both RC4-encrypted by Defender itself), WER reports and crash dumps (size-capped via config.json: werCrashDumps.max_dump_size_mb, default 500 MB), the Windows Search database (Windows.edb/Windows.db, read via VSS), Recycle Bin $I metadata files, the Notification platform database (wpndatabase.db/appdb.dat, read via VSS), and the BITS job database (qmgr0.dat/qmgr1.dat/qmgr.db) — all raw, best-effort, not parsed by this script.
- NEW: -EVTX now also exports a richer, analyst-configurable set of event channels (config.json: logChannels.channels — defaults to System/Security/Application plus Sysmon, Defender Operational, PowerShell, TaskScheduler, WMI-Activity, BITS-Client, and RemoteDesktop Operational) as single-line Event XML per line, ready for direct upload into Forensicator-Core's Log Analysis feature. The original raw .evtx export of System/Security/Application is unchanged. A missing channel (e.g. no Sysmon installed) is detected and skipped with a clear warning instead of silently exporting nothing.
- NEW: Windows Defender status check now also captures IsTamperProtected (tamper-protection-disablement evidence) and a separate current-exclusion-configuration finding (Get-MpPreference) — both collected unconditionally, not gated behind -WINARTIFACTS.
- NEW: -WINARTIFACTS also collects each registry hive's own `.LOG1`/`.LOG2` transaction logs (SYSTEM/SOFTWARE/SECURITY/Amcache.hve and the per-profile NTUSER.DAT/UsrClass.dat), alongside the hive — Forensicator Core replays their uncommitted "dirty page" transactions for a more complete/accurate hive before parsing.
- NEW: -WINARTIFACTS also collects the Windows Timeline database (ActivitiesCache.db, one per user profile, under a randomly-named ConnectedDevicesPlatform\<UUID>\ subfolder this globs for) — raw, for Core to interpret.
- CHANGE: Sigma rule scanning is now OFF by default (config.json: `sigma.enabled`) — it's a real-time scan of Security/System/Sysmon event logs against ~1,400 community rules with meaningful runtime/log-query cost, so it now requires an explicit opt-in, same posture as Forensicator AI's own `enabled` flag.
Contributions are welcome — see CONTRIBUTING.md for repo layout, how to add a detection rule on each platform, and testing/PR guidelines. The short version:
- Open an issue to discuss major changes
- Submit pull requests with clear descriptions
- Focus on accuracy, clarity, and usability
Participation is governed by our Code of Conduct. Found a security vulnerability? Please report it privately — see SECURITY.md rather than opening a public issue.
Live-Forensicator is open-source software licensed under the Apache License 2.0.
Copyright © 2026 Raptormatics LLC.
You are free to use, reproduce, modify, and distribute Live-Forensicator in accordance with the terms of the Apache License 2.0.
See the LICENSE file for the full license text.
Live-Forensicator may include or interact with third-party tools, libraries, scripts, or components that are distributed under their own licenses. Those licenses remain applicable to their respective components.
Users are responsible for complying with the applicable licenses and terms of any third-party components they use with Live-Forensicator.