A Windows artifact collection and parsing tool for targeted digital forensics and incident response investigations.
Hoarder is a forensic artifact collection and parsing tool for Windows systems. It solves the problem of inefficient full-disk imaging by allowing investigators to selectively gather and parse specific artifacts like event logs, registry hives, and browser history, streamlining digital forensics and incident response workflows.
Digital forensics analysts, incident responders, and security professionals who need to conduct targeted investigations on Windows systems without performing full disk acquisitions.
Developers choose Hoarder for its configurable, YAML-driven approach to artifact collection and parsing, which offers precision and efficiency over traditional imaging methods, and its extensibility through custom parsers and plugins.
This script is made to collect the most valiable artifacts for foreniscs or incident reponse investigation rather than imaging the whole har drive.
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Selectively gathers specific Windows forensic artifacts like $MFT and event logs without full disk imaging, reducing data overhead and accelerating incident response.
Allows users to define artifacts, groups, and parsers in Hoarder.yml, enabling customizable and extensible forensic workflows tailored to investigation needs.
Can collect artifacts from live systems or disk image files using the -f flag, providing flexibility for both online and offline forensic scenarios.
Supports parsing raw artifacts into structured data via parsers.zip, with default integration of MasterParser for processing evidence like event logs and registry hives.
Requires manual setup of Hoarder.yml and parsers.zip, which can be time-consuming and error-prone for users unfamiliar with YAML or forensic toolchains.
Limited to Windows forensic artifacts, with no native support for other operating systems, restricting its use in cross-platform investigations.
As of version 4.0.0, 32-bit binaries are not released, forcing reliance on older versions or workarounds for 32-bit endpoints, adding operational complexity.