1 repositorio
Executing agent-based collection logic against a static disk image by emulating a live system environment.
Distinct from Virtual Disk Image Booting: Distinct from booting a VM or importing a disk image; it involves running a specific forensic agent against a mapped image without a full boot process.
Explore 1 awesome GitHub repository matching operating systems & systems programming · Virtual Client Emulation. Refine with filters or upvote what's useful.
Velociraptor is a digital forensics and incident response platform, endpoint detection and response system, and visibility tool. It provides a query engine and remote forensic collector used to hunt for indicators of compromise and perform triage across a fleet of hosts. The system is distinguished by its specialized query language for interrogating host state and parsing binary files. It features a notebook environment that combines markdown documentation with executable query cells to standardize investigative workflows and enable collaborative reporting. The platform covers a wide range o
Velociraptor launches a client using a remapping configuration to collect artifacts from a disk image.