Invoke-LiveResponse
A PowerShell-based live response and forensic collection tool for targeted incident response on Windows systems.
What is Invoke-LiveResponse?
Invoke-LiveResponse is a PowerShell module for live response and forensic data collection on Windows systems during security incidents. It provides two main modes: ForensicCopy for targeted artifact collection and memory acquisition, and Live Response for executing custom PowerShell scripts to gather system data. The tool helps incident responders quickly collect evidence from remote or local machines with minimal footprint.
Security analysts, incident responders, and forensic investigators who need to perform live response on Windows environments, especially in enterprise or targeted investigation scenarios.
Developers choose Invoke-LiveResponse for its flexibility in supporting both predefined forensic collection and custom script execution, compatibility with PowerShell 2.0+, and ability to run over WinRM or locally without requiring heavy dependencies.
Overview
Invoke-LiveResponse
Use Cases
Best For
- Collecting forensic artifacts from Windows systems during incident response
Related Projects
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
