Cross-platform Incident Response & Live Forensics Toolkit
Windows (PowerShell) | Linux (Bash) | macOS (Shell)
Built for fast, structured, and actionable forensic investigations.
Forensicator is a cross-platform incident response and live forensics toolkit.
It is designed to help forensic investigators and incident responders rapidly collect, analyze, and interpret system artifacts during live investigations.
Forensicator:
- Collects system and user activity data
- Detects anomalous behavior and suspicious indicators
- Highlights potential compromise or misconfiguration
- Generates structured, investigation-ready HTML reports
- Advanced Event Log analysis
- Detection of suspicious activity via known Event IDs
- Sigma rule engine (1,400+ community rules) evaluated against Security/Sysmon Event Logs
- Malware hash matching (e.g., abuse.ch feeds)
- Browser history analysis with IOC matching
- Optional artifact encryption (AES)
- Detection Insight - a summary of the detection, why it matters, the detection logic, what to look for, and its MITRE mapping
- Investigation archive + structured JSON output for Forensicator Enterprise
- Forensicator AI — optional, per-finding AI verdicts from a local (Ollama) or commercial LLM, shown in the report's tooltip
👉 https://github.com/Johnng007/Live-Forensicator/tree/main/Windows
- Detection engine covering reverse shells, SIP/Gatekeeper/kext tampering, PATH hijacking, deleted-binary execution, credential timestomping, and more
- Best-effort Sigma rule engine sourced from real SigmaHQ community rules, evaluated against the unified log
- Malware hash matching and browser history IOC matching, with auto-updating abuse.ch/URLhaus feeds
- FileVault, SIP, Gatekeeper, TCC, and Signed System Volume integrity checks
- Application code-signature verification
- Optional artifact encryption (AES)
- Investigation archive + structured JSON output for Forensicator Enterprise
👉 https://github.com/Johnng007/Live-Forensicator/tree/main/MacOS
⚠️ Note: macOS restricts real process-creation telemetry to its Endpoint Security Framework, which a plain script cannot access — so Sigma coverage is narrower here than on Windows/Linux. See the macOS README for specifics.
- Cross-distro compatible Bash scripts, no non-native dependencies
- Detection engine covering reverse shells, timestomping, PATH hijacking, deleted-binary execution, package integrity, and more
- Sigma rule engine sourced from real SigmaHQ community rules, evaluated against auditd and journald where available
- Malware hash matching and malicious URL matching, with auto-updating abuse.ch/URLhaus feeds
- LUKS disk-encryption status and credential-file tampering timeline
- Optional artifact encryption (AES)
- Structured JSON output for Forensicator Enterprise
👉 https://github.com/Johnng007/Live-Forensicator/tree/main/Linux
⚠️ Note: Linux scripts are designed to avoid non-native utilities (e.g.,net-tools) for maximum compatibility. Sigma coverage depends on whetherauditdis already configured on the target box — see the Linux README.
- Cross-platform forensic artifact collection
- Detection of suspicious activity and anomalies on every platform
- Event Log analysis (Windows)
- Sigma rule integration on all three platforms — coverage and data source vary by OS; see each platform's section below and its own README
- Malware hash and IOC matching, with auto-updating threat-intel feeds
- Structured HTML reporting (with dashboards)
- Optional artifact encryption (Windows, Linux, and macOS)
- Detection Insight with Mitre Mapping
- Forensicator AI — optional, per-finding AI verdicts from a local (Ollama) or commercial LLM (Windows now; other platforms planned)
Forensicator generates:
- Clean, structured HTML report
- Indexed findings for easy navigation
- Extracted artifacts stored locally
- Detection insight into each finding.
- Suspicious activity statistics with Sigma Rules.
This enables fast transition from data collection → investigation → decision-making.
- Run scripts with elevated/privileged permissions for best results
- Activity may trigger IDS/IPS alerts — this is expected behavior
- External threat intelligence (hashes, IOCs) may be updated during execution
- Configuration can be customized via
config.json
Forensicator supports optional encryption of collected artifacts using AES.
This is useful when:
- Evidence must be transported securely
- Chain-of-custody concerns exist
- Legal integrity of artifacts must be preserved
⚠️ Available on Windows, Linux, and macOS⚠️ Not backward compatible prior to v4.1.1
Off by default. When enabled, each finding is sent to a local or commercial LLM as it's collected, and gets a real, plain-language verdict shown right in the report's tooltip.
Quick setup (local LLM via Ollama), currently Windows:
# 1. Install Ollama (https://ollama.com) and pull a model
ollama pull mistral:7b-instructPrefer a commercial API instead (OpenAI, Anthropic, Azure OpenAI, or any OpenAI-compatible endpoint)? Set provider accordingly and add your api_key.
📘 Full setup guide (all providers, tuning, troubleshooting): opendocs.forensicator.io
Forensicator identifies suspicious activity through:
- Event Log analysis
- Sigma-based detections
- Malicious hash matching
- IOC-based URL analysis (browser history)
Terminal Output
HTML Dashboard
Terminal Output with Forensicator AI
AI Analysis
Full changelog: 👉 https://opendocs.forensicator.io/changelog/
Windows: v4.2.0 (August 2026)
- NEW: Forensicator AI — optional, per-finding AI verdicts from a local (Ollama) or commercial LLM (OpenAI, Anthropic, Azure OpenAI, or any OpenAI-compatible endpoint), shown right in the report's tooltip. Off by default.
- NEW: Investigation Summary — a cross-finding case rollup with an overall risk score, reconstructed timeline, attack chain, evidence correlation, and recommended next steps, computed from every finding in the run.
- FIX: Investigation Summary's overall risk score no longer inflated by routine, always-present findings (services, scheduled tasks, browser history, running processes, RDP logins, and similar) that carry no evidence of actual compromise — a clean host with zero detections now correctly scores Low instead of High/Critical.
- FIX: Improvements and bug fixes.
Windows: v4.1.7 (July 2026)
- NEW: Added support for PowerShell v5.
- NEW: Active Directory detection module (Domain Controllers only) — NTDS database integrity, SYSVOL/GPO script analysis, privileged group membership, KRBTGT account age, SPN/Kerberoasting exposure, Kerberos delegation, DCSync rights enumeration, DC-specific privileged/Kerberos event collection, and WMI permanent event subscription detection.
- NEW: Microsoft SQL Server detection module — dangerous configuration options (xp_cmdshell, OLE Automation Procedures, CLR), sysadmin/sa account review, linked servers, TRUSTWORTHY databases, SQL Agent job persistence checks, and login failure event collection.
- NEW: Microsoft SharePoint Server detection module — webshell/dropped-file scanning, suspicious IIS worker process (w3wp.exe) child processes, web.config ViewState/machineKey misconfiguration review, and known exploit URI matching in IIS logs.
- FIX: Sigma rule engine returning zero findings on PowerShell 5.1 due to a ConvertFrom-Json array-unrolling difference between PS5.1 and PS7.
- FIX: HTML report rendering broken on PowerShell 5.1 caused by inconsistent Out-File encoding (UTF-16 vs UTF-8) between PowerShell versions.
- FIX: Friendlier error handling when manage-bde.exe is unavailable during BitLocker key extraction.
- FIX: Improvements and bug fixes.Contributions are welcome.
- Open an issue to discuss major changes
- Submit pull requests with clear descriptions
- Focus on accuracy, clarity, and usability
Live-Forensicator is open-source software licensed under the Apache License 2.0.
Copyright © 2026 Raptormatics.
You are free to use, reproduce, modify, and distribute Live-Forensicator in accordance with the terms of the Apache License 2.0.
See the LICENSE file for the full license text.
Live-Forensicator may include or interact with third-party tools, libraries, scripts, or components that are distributed under their own licenses. Those licenses remain applicable to their respective components.
Users are responsible for complying with the applicable licenses and terms of any third-party components they use with Live-Forensicator.