Velociraptor Powered • Digital Defense Institute Maintained

Triage Collector

A ready-to-run Velociraptor package that collects the evidence responders need without extra setup.

Windows x64
Windows x86
Linux x64
macOS Intel x64
macOS Apple Silicon
View on GitHub

Build health

Build Status

Latest workflow run from GitHub Actions

Platforms
Windows Linux macOS
Output

ZIP evidence archive

Velociraptor version

Syncing…

Built: Syncing…

What This Collector Gathers

Includes Volume Shadow Copy snapshots up to 3 days old.

Collects logs, configs, shell history, browser data, SSH keys, systemd, and 130+ forensic targets.

Collects system logs, fseventsd, Unified Logs, Keychain, browser data (Safari, Chrome, Firefox), SSH keys, Photos, TCC permissions, application state, Spotlight, and 80+ macOS-compatible forensic targets.

Would you like to see additional targets added? Open an issue to request them.

How to Use the Collector

  1. 1
    Download

    Grab Velociraptor_Triage_Collector.exe (or the x86 build for 32-bit hosts) and copy it to the target.

  2. 2
    Run as Administrator

    Right-click → Run as administrator, or launch it from an elevated PowerShell / Command Prompt, and let it finish.

  3. 3
    Collect the archive

    Retrieve the generated Triage-<host>-<timestamp>.zip for analysis.

  1. 1
    Download

    Grab Velociraptor_Triage_Collector_Linux and copy it to the target host.

  2. 2
    Make executable & run

    Mark it executable and run it with sudo:

    chmod +x Velociraptor_Triage_Collector_Linux sudo ./Velociraptor_Triage_Collector_Linux
  3. 3
    Collect the archive

    Retrieve the generated Triage-<host>-<timestamp>.zip for analysis.

  1. 1
    Download

    Grab Velociraptor_Triage_Collector_macOS (Intel) or Velociraptor_Triage_Collector_macOS_ARM (Apple Silicon).

  2. 2
    Clear quarantine & run

    Browser downloads are quarantined by Gatekeeper and may report “damaged.” Clear the flag, then run with sudo:

    xattr -d com.apple.quarantine Velociraptor_Triage_Collector_macOS_ARM sudo ./Velociraptor_Triage_Collector_macOS_ARM
  3. 3
    Collect the archive

    Retrieve the generated Triage-<host>-<timestamp>.zip for analysis.

Need timelines? Convert the triage archive into full forensic timelines using our openrelik-pipeline.

Fast Deployment

Single download with pre-packaged artifacts keeps triage moving even during active incidents.

Defender Friendly

Predictable behavior and an open build pipeline reduce the friction of running evidence collection on critical hosts.

Actionable Output

Combines live system data with historical snapshots, giving investigators immediate context.

Need deeper customization?

Fork the project, tweak the Velociraptor artifacts, and keep your responders aligned with your playbooks.

Explore the repository

Threat Hunting & Incident Response with Velociraptor

Hands-on training that dives into the same workflows powering this collector.

Explore the course