Aralez is an advanced Windows triage collection tool designed to streamline the process of gathering critical forensic data. Built with flexibility and automation in mind, it simplifies data collection for incident response and forensic investigations.
Note:
aralez.execan only be executed on Windows and requires administrative privileges.
- Automated Data Collection: Collects data from NTFS file systems, system logs, and critical artifacts with predefined configurations.
- Integrated Tool Support: Supports internal, external, and system tools for comprehensive analysis.
- Encryption for Safety: Ensures sensitive data is encrypted using AES-GCM to protect it from accidental propagation.
- Customizable Configurations: Modify and update the embedded YAML configuration directly or through a new binary.
- Output Compression: Compresses collected data into ZIP archives for easy handling.
- Download: Clone the repository or download the precompiled binary.
- Execute: Run
aralez.exewith administrative privileges on a Windows machine. - Review Outputs: Collected data and logs are stored in a structured format for easy analysis.
Detailed documentation, including configuration guides, usage examples, and tool descriptions, is available on the official website.
We welcome contributions to Aralez! Please submit pull requests with clear descriptions of your changes, or open issues to discuss any improvements or bugs you encounter.
Aralez is open-source software licensed under the Apache-2.0 License. See the LICENSE file for details.