Overview

What TVAK Collector is, the acquisition/analysis split, and how to get it running.

What it is

TVAK Collector is a native Windows DFIR (Digital Forensics & Incident Response) evidence acquisition tool. Point it at a machine and it collects live forensic evidence into a single hash-manifested package for offline analysis. It is the acquisition half of a two-part product:

• Collector (this tool) — thin, fast, portable evidence acquisition only. Runs directly on (or against) the target machine.
• Analyst (a separate product) — the investigation console that processes what Collector produces, offline, away from the target.

Philosophy: collect dumb and fast, judge in analysis

Collector's only job is acquisition. It never makes a forensic judgment about what it collects — for example, Authenticode signature status is captured as enrichment on every record that has one, but it never decides whether to collect or hash something based on it. Filtering, scoring, and correlation happen later, offline, in TVAK Analyst.

Two front-ends, one engine

Both front-ends drive the exact same collection engine, so a GUI run and a headless run of the same selection produce identical results:

• GUI (TvakCollectorGui.exe) — a 3-step wizard for interactive, guided collection. See GUI.
• CLI (TvakCollector.exe) — an interactive text wizard with no arguments, or fully headless/scriptable with flags. See CLI.

System requirements

• Windows 10 or Windows 11, x64. Built and tested on Windows; no other OS is supported.
• No separate .NET install needed. Both exes are published self-contained for win-x64 — the .NET 8 runtime is bundled inside.
• Administrator is recommended, not required. Both exes run asInvoker (no forced UAC prompt) and warn when not elevated. Raw/VSS artifacts need elevation to succeed; everything else works fine unelevated. For full coverage, run as Administrator, or under SYSTEM (e.g. via PsExec -s) for the CLI collector.
• Disk space depends on what you select — a default collection is typically under 2 GB; Hash Inventory's Full mode or a memory dump can be much larger. See Evidence Handling.