Configuration
Every setting Collector exposes, and the Load Profile JSON schema.
Collection Settings (GUI Step 2 / wizard Settings prompt)
| Setting | What it does |
|---|---|
| Output folder | Where the package (and, if enabled, the working folder) is written. |
| Package name + extension | .zip or .tvak — same ZIP-based container either way. Default .zip. See File Formats. |
| Compress package | Deflate compression for text/log artifacts (csv/log/txt/json/xml). Large binaries ($MFT, registry hives, memory dumps) are always stored uncompressed regardless of this toggle. |
| Keep working folder | Retain the intermediate DFIR_<stamp> folder next to the package for debugging, instead of deleting it after packaging. |
| Encrypt package | Disabled "planned" toggle — not implemented yet. See Troubleshooting. |
| Memory acquisition tool | Path to a winpmem executable (auto-detected if one sits next to the exe or in the working directory) and a timeout in minutes. Only shown if Memory is selected. |
| Hash inventory depth | Smart (default, targeted & fast), Extended (+ trusted software roots), Full (every fixed drive, exe/script extensions). Only shown if Hash Inventory is selected. |
Load Profile JSON schema (CLI wizard)
The wizard's [3] Load Profile option loads modules and settings from a JSON
file. Unknown module names are warned about and ignored, never trusted blindly. A loaded profile
pre-fills the Settings prompts rather than skipping them, so you still see and can
override every value before the run starts.
{
"Modules": ["System", "Processes", "Network", "EventLogs"],
"HashMode": "Smart",
"Memory": false,
"OutputDirectory": "C:\\Evidence",
"PackageName": "CASE-1234",
"PackageExtension": "zip",
"Compress": true,
"KeepWorking": false
}