Error Reference
Every real status value a package can record.
Collector never silently drops a failure. These are the exact status enums used in
manifest.json, taken directly from the source.
Collector status (CollectorsRun[].Status)
| Status | Meaning |
|---|
Success | Ran to completion normally. |
Failed | Did not complete — reason recorded in Reason. |
Skipped | Not selected for this run, or a required tool/condition wasn't present. |
Partial | Interrupted mid-run by a cancel; whatever it had collected so far was flushed and kept. |
Raw artifact method (RawArtifacts[].Method)
| Method | Meaning |
|---|
VSS | Copied via a Volume Shadow Copy snapshot. |
LiveFallback | VSS wasn't available or failed; copied from the live volume instead (only attempted for the $MFT/Prefetch family, never for registry hives). |
Failed | Every attempt failed — reason recorded. |
NotPresent | Source genuinely doesn't exist (e.g. an empty RegBack folder on modern Windows) — informational, not a failure. |
Memory acquisition method (Memory.Method)
| Method | Meaning |
|---|
Success | Tool exited cleanly and produced a non-empty dump. |
Partial | Hit the timeout; the partial dump was retained and hashed rather than discarded. |
Failed | Tool missing, not elevated, or exited with an error/empty output. |
Skipped | Memory wasn't selected for this run. |
