An independent tool index
for incident response teams
Digital forensics Institution-led
Windows forensic acquisition utility for collecting incident response artefacts from hosts into structured archives for later analysis and evidence handling.
By ANSSI · France
Primary sources connect this project to an EU public or research institution.
Managed by ANSSI, the French cybersecurity agency, with the repository explicitly naming ANSSI stewardship.
Windows-only collection tool. Its release notes concern forensic acquisition; no claim of evidentiary integrity certification is implied.
identity / origin / country / capabilities / deployment
The repository describes Windows forensic artefact collection, documents building the executable, and expressly says ANSSI manages the project.
Read sourcelicense
Upstream license is GNU Lesser General Public License 2.1.
Read sourcemaintenance
Release v10.4.0 was published 8 October 2026 with collection and upload changes.
Read sourcecountry
ANSSI organization profile identifies its repositories as agency-developed projects and its French national agency role.
Read sourceThis profile summarizes source material. It does not include hands-on security testing, procurement review, or an assessment of fit for your environment.
Tags record specific documented functions. They do not establish end-to-end interoperability; check the component, edition and version in the source.
Uses configured YARA rules for file matching. In the documented 10.3.x scanner, blocks currently falls back to file-mapping behavior for compatibility; legacy block scanning can miss whole-file matches. Timeouts and scan-method limits apply.
Plan targeted evidence collection, check acquisition gaps and produce a traceable timeline. Source-linked guidance for Acquire, Dissect and DFIR ORC.
A digital forensics triage and evidence workflow