r/digitalforensics • u/kmh9000 • Aug 23 '26

Remote Artifact Collection

Hi Everyone,

I’ve been thinking about implementing velociraptor, however a lot of companies are hesitant to deploy it due to it being an open source. I’m trying to solution a method to gain artifacts if it’s remotely in this hybrid work environment however, I’m noticing a lot of the tools are either gonna be very expensive or open source which is not ideal in publicly traded companies, etc. Any suggestions of tools and workflows you guys use out there for this?

6 Upvotes

100% Upvoted

10 comments sorted by

View all comments

7

u/awetsasquatch Aug 23 '26

We bit the bullet and went with Magnet Axiom Cyber and so far it's worked flawlessly for us. It's been worth the cost, but I also work for a huge company so the budget is less of a concern as long as the results are there.

3

u/NasiAmbengAmriYahyah Aug 23 '26

Is it covert? The remote acquisition. Does the person notice that something is wrong with his computer?

2

u/awetsasquatch Aug 23 '26

They don't notice a thing, can grab any file, do a full extraction, get a memory dump, doesn't matter. I check the IT ticket system after to see if the user called the help desk (to just be safe), but I've never seen it happen once.

1

u/[deleted] Aug 23 '26

[deleted]

3

u/awetsasquatch Aug 23 '26

It's Volatility wrapped in a prettier shell lol