Forensic log collection tool (free)
Blue Collector
Collect endpoint evidence
in minutes at the start of an incident
Just run it on the target endpoint, and it packages the artifacts needed for a forensic investigation into a single zip. Supports Windows, macOS, and Linux.
Latest version v0.4.8
zip format, each 3 MB or less. Hash values and notes
Features
Blue Collector Features
Extracts only the evidence you need
Without taking a full disk image, it collects only the needed amount of $MFT, files, registry, and command and WMI output, and packages them into a zip.
No installation required
It is a single binary. Bring it to the target endpoint on a USB drive or similar and run it as-is.
For investigating insider threats, malware, and information leaks
Collects security settings, persistence mechanisms, operation history, cloud service usage, credential storage status, and more.
Collected data is encrypted and preserved
Collected files are stored encrypted, and CoWorker performs decompression and analysis. If you would like analysis, please contact us. Older Windows endpoints are also supported.
Usage
How to Use
- 01
Download the build for your OS
Choose the zip that matches the OS of the target endpoint and verify the hash value.
- 02
Run with administrator privileges
On Windows, double-click (allow UAC); on Linux and macOS, run with root privileges.
- 03
Collection completes in a few minutes
The collected zip and a log file are created in the location where you ran it.
- 04
Contact us
Attach the collected zip and request analysis.
Download
Download
zip format (1.5 MB)
zip format (2.8 MB)
zip format (1.3 MB)
Check the hash values (SHA-256)
- blue-collector-v0.4.8-windows.zip
c4fa1a8b27f9cd14573623c5c4f351744a89c0a25f3b2a3eeb9ae032250eadf9- blue-collector-v0.4.8-macos.zip
b54c5c50000af7ced72c28a97ac1042bd219407e7a56b5b277166c37a3007527- blue-collector-v0.4.8-linux.zip
29ec66445c9a5d666fc90c16a1a2adca76146697c910900ff1d6b85798dd29ff
How to verify: Windows certutil -hashfile filename SHA256 / macOS shasum -a 256 filename / Linux sha256sum filename
Terms of Use
- Because it collects important system files, antivirus software may detect it as malware.
- If execution is blocked on macOS, right-click the app and choose “Open”. On Linux, run it like sudo ./blue-collector.
- The collected zip contains sensitive information, so please handle it with care.
- This tool is provided free of charge, and we are not liable for any damage arising from its use. Use it only on endpoints you manage or endpoints for which you have permission to investigate.
Contact
We support new business, product development, and organizational development.
Please feel free to contact us.