Evidence Handling
What each module collects, and where it ends up in the package.
Evidence modules reference
Module (--modules key) | Collects |
|---|---|
System | OS details, boot/install time, domain, logged-on user, source timezone, USB device history, and NTFS alternate data streams |
Processes | Always collected, can't be deselected. Running processes with full path, command line, parent PID, SHA-256 hash, Authenticode signature |
Network | Active TCP connections with owning process and image path |
Services | Windows services — path, state, start mode, logon account, signature |
Persistence | Registry Run keys, WMI event-consumer subscriptions, startup-folder items |
Tasks | Scheduled tasks — author, resolved action, target-binary signature |
Users | Local user accounts and local Administrators group membership |
EventLogs | Security/System/Application/PowerShell/Sysmon/Task Scheduler event logs, plus a security triage CSV |
Raw | $MFT, $LogFile, $UsnJrnl:$J, Prefetch, registry hives (SYSTEM/SOFTWARE/SAM/SECURITY + RegBack), Amcache, SRUM, per-user NTUSER.DAT/UsrClass.dat. VSS-required for hives; VSS-with-live-fallback for the $MFT family |
Browser | Browser history and downloads — Chrome, Edge, Brave, Firefox |
HashInventory | SHA-256 inventory of execution/persistence targets plus attacker-favored directories. Three depths: Smart (default), Extended, Full |
| Memory (Volatile) | Not a --modules key — opt-in separately. Bring-your-own winpmem. See Troubleshooting. |
Where evidence lands in the package
Each module that produces output gets its own subfolder under artifacts/ in the
package. Every file is SHA-256 hashed and recorded in manifest.json, alongside a
per-collector run status (Success/Failed/Skipped/Partial).
Full package layout and manifest schema: Reference › File Formats.