Forensicator

Spec sheet

What it does

Forensicator collects live host and network evidence, analyzes it, and produces structured investigation reports.Read 15 Oct 2026 · forensicator.io

Purpose

Forensicator collects, analyzes, and interprets system artifacts during live investigations and produces structured HTML reports.Read 29 Sep 2026 · opendocs.forensicator.io

Audience

Enterprise is presented for security operations centers, incident response and digital forensics teams, and MSSPs.Read 29 Sep 2026 · forensicator.io

Deployment

Core is self-hosted through Docker Compose or a Debian/Ubuntu host and supports offline update packages for air-gapped use.Read 15 Oct 2026 · forensicator.io

API

Core provides REST API keys for integrations and automation.Read 15 Oct 2026 · forensicator.io

Security

Enterprise describes organization-scoped role-based access, hashed API keys, activity logging, configurable data retention, and local-model support for offline AI analysis.Read 29 Sep 2026 · forensicator.io

License

The documentation states that Forensicator is released under the MIT License.Read 15 Oct 2026 · opendocs.forensicator.io

AI investigation

Forensicator AI offers optional per-finding verdicts and a cross-finding summary with a risk score, timeline, and attack chain on Windows.Read 29 Sep 2026 · opendocs.forensicator.io

AI providers

AI analysis can use local Ollama or commercial providers including OpenAI, Azure OpenAI, Anthropic, or an OpenAI-compatible endpoint.Read 29 Sep 2026 · opendocs.forensicator.io

Case management

Core organizes investigations, hosts, findings, notes, bookmarks, and incident-response playbooks into cases.Read 15 Oct 2026 · forensicator.io

Collection features

Windows collection includes RAM acquisition through WinPmem and live network capture converted to PCAP for Wireshark.Read 29 Sep 2026 · forensicator.io

Collector platforms

The collector supports Windows PowerShell, Linux Bash, macOS Shell, and SSH-based network-device collection.Read 15 Oct 2026 · opendocs.forensicator.io

Community visibility

The GitHub repository page displayed 635 stars, 94 forks, and 350 commits when opened.Read 15 Oct 2026 · github.com

Core analysis engines

Core analyzes memory images with Volatility3, PCAP files, raw logs, and Windows forensic artifacts.Read 15 Oct 2026 · forensicator.io

Detection

The toolkit evaluates more than 1,400 community Sigma rules, with coverage and data sources varying by operating system.Read 29 Sep 2026 · forensicator.io

Directory availability

Capterra's October 15, 2026 digital-forensics directory page listed 45 products but did not show Forensicator among the displayed products.Read 15 Oct 2026 · capterra.com

Documentation

The documentation site contains getting-started, Windows, Linux, macOS, output, advanced-usage, and changelog sections.Read 15 Oct 2026 · opendocs.forensicator.io

Encryption

Collected artifacts can be optionally encrypted with AES on Windows, Linux, macOS, and network devices.Read 15 Oct 2026 · opendocs.forensicator.io

Enterprise

Forensicator Enterprise is self-hosted software for uploading, correlating, and managing collector reports across teams.Read 29 Sep 2026 · forensicator.io

Enterprise access control

Enterprise provides organization-scoped role-based access, hashed prefix-indexed API keys, configurable retention, and activity logging.Read 15 Oct 2026 · forensicator.io

Enterprise extensibility

Enterprise exposes REST operations, webhooks, and structured JSON exports for ticketing, chat, SIEM, and SOAR integrations.Read 15 Oct 2026 · forensicator.io

Enterprise integrations

Enterprise exposes an authenticated REST API, webhooks, and structured JSON export; specific SIEM, ticketing, or SOAR integrations are not listed.Read 29 Sep 2026 · forensicator.io

Enterprise workflow

Enterprise accepts collector archives through an API-key-authenticated API or web interface and schema-validates findings on ingest.Read 15 Oct 2026 · forensicator.io

Independent project listing

SourceForge mirrors the Live-Forensicator GitHub project, lists Linux, Mac, and Windows, and showed eight downloads during the displayed week.Read 15 Oct 2026 · sourceforge.net

Independent usage

A Blue Team Labs Online case study used Live Forensicator to collect Windows event logs, identify account lockouts, inspect persistence registry keys, and review browser history.Read 15 Oct 2026 · linkedin.com

Limit: platform parity

The documentation says AI, investigation summaries, and AD/MSSQL/SharePoint detection are Windows-only, while macOS Sigma coverage is narrower and macOS artifact decryption is unavailable.Read 15 Oct 2026 · opendocs.forensicator.io

Limit: verbosity

A LinkedIn DFIR discussion describes Live Forensicator as a quick alternative but says it is less verbose than Velociraptor on Windows.Read 15 Oct 2026 · linkedin.com

Linux features

Linux collection uses native commands, checks reverse shells, timestomping, PATH hijacking, deleted binaries and package integrity, and evaluates Sigma rules against auditd or journald when available.Read 15 Oct 2026 · opendocs.forensicator.io

macOS features

macOS collection checks SIP, Gatekeeper, SSV and kext tampering, browser history, code signatures, and best-effort Sigma detections.Read 15 Oct 2026 · opendocs.forensicator.io

Maker attribution

The Forensicator site footer attributes the product to Raptormatics.Read 15 Oct 2026 · forensicator.io

Network-device support

Network collection uses Netmiko over SSH for Cisco IOS/IOS-XE, Cisco NX-OS, Arista EOS, Juniper Junos, and VyOS.Read 15 Oct 2026 · github.com

Notable limits

Forensicator AI, the Investigation Summary, and Active Directory/MSSQL/SharePoint detection are Windows-only; macOS Sigma coverage is narrower than on Windows and Linux.Read 29 Sep 2026 · opendocs.forensicator.io

Offline operation

Enterprise states that it has no mandatory outbound runtime calls and can use a local Ollama model for fully offline analysis.Read 15 Oct 2026 · forensicator.io

Project activity

The GitHub repository page showed a latest update in September 2026 and identifies PowerShell as its primary language.Read 15 Oct 2026 · github.com

Rating on SourceForge

No user rating was displayed and no review count was shown on the opened SourceForge reviews page.Read 15 Oct 2026 · sourceforge.net

Reporting

Core exports executive and technical reports in PDF, CSV, JSON, and ZIP formats.Read 15 Oct 2026 · forensicator.io

Reports and output

Runs produce a searchable HTML report and a structured investigation JSON folder; Windows also produces a case-summary JSON rollup.Read 29 Sep 2026 · opendocs.forensicator.io

Security limitation

The documentation warns that scripts should run with elevated privileges, may trigger IDS/IPS alerts, and can overwrite a previous output folder when rerun on the same host.Read 15 Oct 2026 · opendocs.forensicator.io

Setup

The collector runs from a cloned repository without an agent or provisioning, and requires elevated permissions for full artifact access.Read 29 Sep 2026 · forensicator.io

Threat intelligence

Malware hash and IOC matching uses auto-updating threat-intelligence feeds, including abuse.ch and URLhaus.Read 29 Sep 2026 · opendocs.forensicator.io

Threat intelligence integrations

Core lists VirusTotal, AbuseIPDB, OTX, URLhaus, ThreatFox, and MalwareBazaar integrations.Read 15 Oct 2026 · forensicator.io

Windows features

Windows collection includes event-log analysis, 1,400-plus Sigma rules, malware-hash matching, browser IOC matching, RAM capture, PCAP capture, and role-aware AD/MSSQL/SharePoint checks.Read 15 Oct 2026 · opendocs.forensicator.io

Plans and prices

Every Forensicator plan and price →

Where Specifiction places it

• Incident Response Software#4 of 218.6