windowscollector

README

Forensic Collector

The Forensic Collector is geared towards augmenting EDR toolsets. Unfortunately, not all EDR toolsets have the capability of collecting forensically relevant files from endpoints. The GoFor Collector looks to remedy that.

Usage

   
Flags:
  --help                         Show context-sensitive help (also try
                                 --help-long and --help-man).
  --debug                        Enable debug mode.
  --all                          Collect all forensic artifacts.
  --mft                          Collect the system drive MFT.
  --mft-all                      Collect all attached volume MFTs.
  --mft-letters=MFT-LETTERS ...  Collect volume MFTs by volume letter.
  --reg                          Collect all registry hives, both system and
                                 user hives.
  --events                       Collect all event logs.
  --browser                      Collect browser history
  --custom-config=CUSTOM-CONFIG  Custom configuration file that will overwrite
                                 built in config.
  --throttle                     This setting will limit the process to a single
                                 thread. This will reduce the CPU load.
  --output=OUTPUT                Specify the name of the output file. If not
                                 specified, the file name defaults to the host
                                 name and a timestamp.

Examples

Collect all the things: forensic-collector.exe --all

Collect just the system drive MFT and export to a custom name zip file: forensic-collector.exe --mft --output out.zip

Collect event logs and registry hives: forensic-collector.exe --events --reg

Use a custom configuration for collection (see example config in config/config.yml): forensic-collector.exe --custom-config config.yml

Documentation

Index

• func Collect(injectedHandlerDependency handler, exportList ListOfFilesToExport, ...) (err error)
• type FileToExport
• type ListOfFilesToExport
• type VolumeHandler
  • func GetVolumeHandler(volumeLetter string, handler handler) (volume VolumeHandler, err error)
  • func (volume VolumeHandler) GetHandle(volumeLetter string) (handle *os.File, err error)
• type ZipResultWriter
  • func (zipResultWriter *ZipResultWriter) ResultWriter(fileReaders chan fileReader, waitForFileCopying *sync.WaitGroup) (err error)

Functions

func Collect

func Collect(injectedHandlerDependency handler, exportList ListOfFilesToExport, resultWriter resultWriter) (err error)

Collect will find and collect target files into a format depending on the resultWriter type

Types

type FileToExport

type FileToExport struct {
	FullPath        string `yaml:"FullPath"`
	IsFullPathRegex bool   `yaml:"IsFullPathRegex"`
	FileName        string `yaml:"FileName"`
	IsFileNameRegex bool   `yaml:"IsFileNameRegex"`
}

FileToExport is the file that you want to export.

type ListOfFilesToExport

type ListOfFilesToExport []FileToExport

ListOfFilesToExport is a slice of files that you want to export.

type VolumeHandler

type VolumeHandler struct {
	Handle       *os.File
	VolumeLetter string
	Vbr          vbr.VolumeBootRecord
	// contains filtered or unexported fields
}

VolumeHandler contains everything needed for basic collection functionality

func GetVolumeHandler

func GetVolumeHandler(volumeLetter string, handler handler) (volume VolumeHandler, err error)

GetVolumeHandler gets a file handle to the specified volume and parses its volume boot record.

func (VolumeHandler) GetHandle

func (volume VolumeHandler) GetHandle(volumeLetter string) (handle *os.File, err error)

GetHandle will get a file handle to the underlying NTFS volume. We need this in order to bypass file locks.

type ZipResultWriter

type ZipResultWriter struct {
	ZipWriter  *zip.Writer
	FileHandle *os.File
}

ZipResultWriter contains the handles to the file and zip structure

func (*ZipResultWriter) ResultWriter

func (zipResultWriter *ZipResultWriter) ResultWriter(fileReaders chan fileReader, waitForFileCopying *sync.WaitGroup) (err error)

ResultWriter will export found files to a zip file.