Hoarder
A Windows artifact collection and parsing tool for targeted digital forensics and incident response investigations.
What is Hoarder?
Hoarder is a forensic artifact collection and parsing tool for Windows systems. It solves the problem of inefficient full-disk imaging by allowing investigators to selectively gather and parse specific artifacts like event logs, registry hives, and browser history, streamlining digital forensics and incident response workflows.
Digital forensics analysts, incident responders, and security professionals who need to conduct targeted investigations on Windows systems without performing full disk acquisitions.
Developers choose Hoarder for its configurable, YAML-driven approach to artifact collection and parsing, which offers precision and efficiency over traditional imaging methods, and its extensibility through custom parsers and plugins.
Overview
This script is made to collect the most valiable artifacts for foreniscs or incident reponse investigation rather than imaging the whole har drive.
Use Cases
Best For
- Targeted incident response investigations on Windows endpoints
Related Projects
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
