CLI
Full headless flag reference.
tvak Collector (TvakCollector.exe) [options]
-o, --output <dir> Output root for the package and working files (default: current dir)
--modules <list> System,Processes,Network,Services,Persistence,Tasks,Users,EventLogs,Raw,
Browser,HashInventory,All (default: All)
--extension <ext> Output package extension: zip or tvak (default: zip)
--memory Acquire volatile RAM, auto-detecting a winpmem exe next to this
collector or in the working directory (v1: go-winpmem). Requires admin.
--memory-tool <path> As --memory, but with an explicit winpmem path (always wins over
auto-detect). Either flag opts memory in; neither -> memory skipped.
--memory-timeout <min> Hang safety-net for memory acquisition (default: 60)
--keep-working Keep the intermediate DFIR_<stamp> working folder
-h, --help This help| Flag | Default | Notes |
|---|---|---|
-o, --output <dir> | current directory | Output root for the package and working files. |
--modules <list> | All | Comma-separated. Processes always runs regardless. |
--extension <zip|tvak> | zip | Same ZIP-based container either way. |
--memory | off | Opt in, auto-detect winpmem. Requires admin. |
--memory-tool <path> | — | Explicit winpmem path; wins over auto-detect. |
--memory-timeout <min> | 60 | Partial dump retained on timeout. |
--keep-working | off | Keep the DFIR_<stamp> working folder. |
-h, --help | — | Prints help; bypasses the wizard like any other argument. |
Exit code is non-zero if any collector (or Raw/VSS artifact) ended up Failed.