How do I add a custom artifact to Hoarder?

Edit Hoarder.yml to define a new artifact entry with keys like output, path32/64, files, and parsers. Then, place any required parser binaries in parsers.zip, and Hoarder will incorporate them during execution for targeted collection and parsing.

Hoarder vs Kuiper: which is better for Windows forensics?

Hoarder excels at configurable, targeted artifact collection and parsing via YAML, ideal for precise investigations. Kuiper is a broader forensic analysis platform with a GUI, better for comprehensive evidence review. Choose based on whether you need customization or out-of-the-box analysis.

Can Hoarder collect artifacts from a disk image?

Yes, use the -f flag followed by the disk image file path to collect artifacts from an image instead of a live system. This allows offline forensic analysis without modifying the original evidence.

What parsers are included with Hoarder by default?

Hoarder's binary release includes MasterParser by default in parsers.zip for parsing common Windows artifacts like event logs and MFT. Users can replace or extend this with custom parsers by updating parsers.zip.

Is Hoarder suitable for enterprise incident response teams?

Hoarder is useful for rapid triage and targeted collections in enterprises due to its efficiency, but its manual configuration and lack of centralized management may limit scalability for large, distributed environments requiring automation.

How to use group tags in Hoarder for scenario-based investigations?

Define groups in Hoarder.yml under artifact entries, then use the -g flag in the command line to collect all artifacts tagged with those groups. This streamlines evidence collection for specific scenarios like malware analysis or user activity tracking.

Open-Awesome

Hoarder

GPL-3.0Python4.0.0

A Windows artifact collection and parsing tool for targeted digital forensics and incident response investigations.

GitHub

216 stars23 forks0 contributors

What is Hoarder?

Hoarder is a forensic artifact collection and parsing tool for Windows systems. It solves the problem of inefficient full-disk imaging by allowing investigators to selectively gather and parse specific artifacts like event logs, registry hives, and browser history, streamlining digital forensics and incident response workflows.

Target Audience

Digital forensics analysts, incident responders, and security professionals who need to conduct targeted investigations on Windows systems without performing full disk acquisitions.

Value Proposition

Developers choose Hoarder for its configurable, YAML-driven approach to artifact collection and parsing, which offers precision and efficiency over traditional imaging methods, and its extensibility through custom parsers and plugins.

Overview

This script is made to collect the most valiable artifacts for foreniscs or incident reponse investigation rather than imaging the whole har drive.

Use Cases

Best For

Targeted incident response investigations on Windows endpoints
Collecting specific forensic artifacts like $MFT or event logs
Live forensics without full disk imaging
Parsing Windows artifacts with custom tools via MasterParser
Scenario-based evidence collection using group tags
Rapid triage during security incidents

Not Ideal For

Investigations requiring full disk imaging for legal evidence admissibility
Forensic analysis on non-Windows operating systems like Linux or macOS
Teams needing out-of-the-box tools without YAML configuration or parser management
Large-scale, automated evidence collection across distributed enterprise networks

Pros & Cons

Pros

Targeted Artifact Collection

Selectively gathers specific Windows forensic artifacts like $MFT and event logs without full disk imaging, reducing data overhead and accelerating incident response.

Configurable via YAML

Allows users to define artifacts, groups, and parsers in Hoarder.yml, enabling customizable and extensible forensic workflows tailored to investigation needs.

Live and Image Support

Can collect artifacts from live systems or disk image files using the -f flag, providing flexibility for both online and offline forensic scenarios.

Integrated Parsing Pipeline

Supports parsing raw artifacts into structured data via parsers.zip, with default integration of MasterParser for processing evidence like event logs and registry hives.

Cons

Configuration Complexity

Requires manual setup of Hoarder.yml and parsers.zip, which can be time-consuming and error-prone for users unfamiliar with YAML or forensic toolchains.

Windows-Only Focus

Limited to Windows forensic artifacts, with no native support for other operating systems, restricting its use in cross-platform investigations.

Deprecated 32-bit Support

As of version 4.0.0, 32-bit binaries are not released, forcing reliance on older versions or workarounds for 32-bit endpoints, adding operational complexity.

Frequently Asked Questions

Related Projects

LOKI

Loki - Simple IOC and YARA Scanner

Stars3,773

Forks615

Last commit6 months ago

Fibratus

Adversary tradecraft detection, protection, and hunting

Stars2,503

Forks217

Last commit2 days ago

PowerForensics

PowerForensics provides an all in one platform for live disk forensic analysis

Stars1,441

Forks282

Last commit2 years ago

RegRipper

RegRipper3.0

Stars712

Forks151

Last commit1 month ago

Community-curated · Updated weekly · 100% open source

Found a gem we're missing?

Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.

Submit a project Star on GitHub