artifactcollector
A customizable single-binary agent for collecting forensic artifacts from Windows, macOS, and Linux systems.
What is artifactcollector?
artifactcollector is a forensic tool that collects specific artifacts from Windows, macOS, and Linux systems for investigative purposes. It extracts targeted data like files, registry keys, and system outputs without requiring full disk images, streamlining forensic analysis. The tool is distributed as a single binary that can be deployed directly on systems under investigation.
Digital forensic investigators, incident responders, and security professionals who need to collect targeted forensic evidence from diverse operating systems during investigations.
Developers choose artifactcollector for its portability as a single binary, cross-platform compatibility including legacy Windows versions, and extensible artifact definitions based on the Forensic Artifacts framework, enabling customizable and efficient evidence collection.
Overview
🧭 The artifactcollector is a customizable agent to collect forensic artifacts on any Windows, macOS or Linux system
Use Cases
Best For
- Collecting targeted forensic artifacts without full disk imaging
- Cross-platform forensic investigations on Windows, Linux, and macOS
- Incident response where quick evidence collection is needed
- Extracting registry keys and system artifacts from Windows machines
- Using predefined artifact definitions from forensic frameworks
- Deploying forensic tools as standalone executables on investigated systems
Not Ideal For
- Investigations requiring full disk imaging for legal or comprehensive evidence
- Environments with strict anti-malware policies that block unsigned or suspicious binaries
- Real-time forensic monitoring or continuous data collection scenarios
- Users needing a graphical interface for ease of use without command-line expertise
Pros & Cons
Pros
Runs on Windows, Linux, and macOS, including legacy Windows versions like 2000/XP, as highlighted in the features section, ensuring broad investigative reach.
Distributed as a standalone executable that can be transferred to target systems, minimizing dependencies and simplifying forensic tool deployment in the field.
Uses the configurable and extensible Forensic Artifacts framework, allowing customization of collection rules through YAML files, as described in the 'Build your own artifactcollector' section.
Can run additional embedded binaries as part of collection, enabling extended forensic capabilities like running external tools, with examples provided in the 'Embed binaries' section.
Cons
The README warns it behaves similarly to malware and might be flagged by antivirus software, complicating deployment in security-sensitive environments.
Adding or modifying artifacts requires editing YAML files and recompiling the binary with make commands, which adds overhead for non-developers or rapid adjustments.
Collection can take several minutes depending on system resources and artifact definitions, potentially slowing down time-sensitive incident response efforts.
Frequently Asked Questions
Related Projects
bulk_extractorThis is the development tree. Production downloads are at:
UACUAC is a powerful and extensible incident response tool designed for forensic investigators, security analysts, and IT professionals. It automates the collection of artifacts from a wide range of Unix-like systems, including AIX, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD and Solaris.
Forensic Artifact repositoryDigital Forensics artifact repository
CyLRCyLR - Live Response Collection Tool
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.