FastIR collector

FastIR_Collector.exe --output <dir>

Collect artifacts from a Windows host with FastIR Collector, the community triage collector that gathers system data.

Run it when you need triage collection with the community tool: FastIR Collector gathers host artifacts — system information, processes, connections, registry (Run keys, services), recent files — and saves them to the output directory with a category-based structure. It's the community triage collector (from the French-speaking DFIR scene, with its FastIR suite). In IR, FastIR is the quick triage collection option: system data in a directory, with persistence artifacts included.

Don't use it as a full forensic collection: FastIR covers triage (processes, network, registry, files) — deep artifacts (MFT, raw EVTX) require KAPE or CyLR. The project is barely maintained (the current alternative is KAPE/CyLR): compatibility with new Windows versions may fail. And watch out: execution minimally alters the system and requires admin for full collection. For triage with standardized artifacts, use KAPE; FastIR is the historical option for point-in-time triage collection.