Tvak Collector v0.1.0

Tvak Collector v0.1.0

Tvak Collector is a native Windows DFIR evidence acquisition tool — GUI and CLI, no installer,
no dependencies. It acquires live forensic evidence from a Windows host and writes it into a
single, self-identifying, hash-manifested package (.zip or .tvak) for offline review.

This is the first public release of Tvak Collector. It's early (v0.1.0) — the core
acquisition engine, both front-ends, and the package format are built and working, but treat
this as a young release rather than a mature, battle-tested tool. See Honest limitations
below before you rely on it for real casework.

What's in this release

Two self-contained Windows x64 binaries — no .NET runtime install required on the target
machine:

• TvakCollector-CLI-v0.1.0-win-x64.zip — TvakCollector.exe, a single portable exe.
  Run with no arguments for an interactive wizard, or pass flags for a scripted/headless run.
• TvakCollectorGui-v0.1.0-win-x64.zip — the full TvakCollectorGui folder. Extract and
  run TvakCollectorGui.exe from inside that folder (folder-published, not single-file —
  keep the exe with the files alongside it).

Both drive the exact same collection engine, so a GUI run and a headless run of the same
module selection produce identical results. Evidence modules include process/network/service/
persistence/scheduled-task/user enumeration, event logs, browser history, raw/VSS acquisition
($MFT, registry hives, Prefetch, USN journal), a three-depth Hash Inventory (Smart / Extended /
Full — all three modes are supported and functional), and optional bring-your-own-winpmem
memory acquisition. Full module and package-format reference: docs.tvaksecurity.com.

Verifying the download

The binaries in this release are unsigned (see Honest limitations).
Verify their SHA-256 before trusting them:

87FA2D677EFEB888119AAEA459E1A9019E58715AAA71B5D2DB9F307618CF6333  TvakCollector-CLI-v0.1.0-win-x64.zip
8957588E5DDAED1D8B6E66AB1478EECE05EE67C98B1F908FF06BB3D6F2F11CF5  TvakCollectorGui-v0.1.0-win-x64.zip

Also attached as SHA256SUMS.txt. On Windows:

Get-FileHash .\TvakCollector-CLI-v0.1.0-win-x64.zip -Algorithm SHA256

Or with a standard sha256sum (WSL/Linux/macOS):

sha256sum -c SHA256SUMS.txt

If you'd rather not trust a downloaded binary at all, build from source — see the
README.

Honest limitations

• Binaries are unsigned. No code-signing certificate yet. Build from source yourself, or
  verify the SHA-256 above before trusting a downloaded binary.
• Memory acquisition is bring-your-own. Tvak Collector does not bundle or download a
  memory-capture tool — it orchestrates a user-supplied winpmem executable. Requires
  Administrator.
• Administrator is required for Raw/VSS and Memory collection. Everything else (processes,
  network, services, persistence, tasks, users, event logs, browser, Hash Inventory) works
  fine unelevated, with reduced coverage of protected locations.

License

Code: Apache License 2.0.

The "Tvak" name and shield mark are trademarks of Prince (Tvak Security) and are not
covered by the Apache-2.0 code license — see
TRADEMARK for what
that means in practice.

Copyright © 2026 Prince (Tvak Security) — tvaksecurity.com

Binary signing: the released TvakCollectorGui.exe / TvakCollector.exe builds are currently unsigned (build.ps1 has a code-signing step, gated behind a $sign flag, that isn't turned on yet). Code signing for Windows binaries is being set up through the SignPath Foundation's free code signing program for open-source projects. Until that is in place, if signing matters for your use case, either build from source yourself (see Building from source — build.ps1 prints the SHA-256 of each exe it produces) or verify a downloaded release's SHA-256 against the hash published with that release before trusting it.