Troubleshooting

Known, documented behavior — not discovered the hard way.

• No open-handle enumeration. The Processes module captures process metadata (path, command line, parent PID, hash, signature) via WMI — it does not enumerate each process's open file/handle table. If you need that, it's not currently implemented.
• RegBack "empty" is NotPresent, not a failure. On Windows 10 1803+ and Windows 11, C:\Windows\System32\config\RegBack is empty by default (Microsoft disabled the periodic backup) — Collector correctly records this as NotPresent (informational, doesn't count against collection health), not Failed. A RegBack file that genuinely exists but fails to copy is still recorded as a real Failed.
• Hash Inventory Extended/Full modes are less exercised than Smart. Smart (the default) has been verified end-to-end on real hardware. Extended and Full are implemented and functionally verified but have seen less real-world mileage — they can be slow and produce very large inventories.
• Memory acquisition orchestrates, it doesn't implement. Collector never reads physical memory itself — it shells out to a user-supplied winpmem executable, captures its full console output, and hashes/packages whatever dump it produces. You need winpmem (or an equivalent) on hand.
• Package encryption is a UI placeholder, not implemented. The "Encrypt package" toggle in Collection Settings is visibly disabled ("Planned"). No crypto dependency is bundled. When it ships: optional, off by default, layered on top of (never a substitute for) the SHA-256 integrity manifest, standard WinZip AES-256 — never a proprietary format.
• $MFT parsing isn't cancel-interruptible mid-parse. Collection-wide cancel stops other heavy collectors mid-loop, but the $MFT parse itself is a single monolithic operation — cancel is honored before it starts, not during.

For the exact status values a package can record, see Reference › Error Reference.