PowerTriage
2.3.4
It focuses on practical live response, low deployment friction, and dependency-free artifact collection in the Community Edition.
Community Edition highlights:
- Native PowerShell: Runs on standard PowerShell 5.1+
- Liv
It focuses on practical live response, low deployment friction, and dependency-free artifact collection in the Community Edition.
Community Edition highlights:
- Native PowerShell: Runs on standard PowerShell 5.1+
- Live Triage: Focused on rapid collection from running Windows hosts
- Broad Coverage: Network, process, persistence, system, browser, cloud, and user artifacts
- Browser Forensics: Chrome, Edge, Firefox, Opera, Brave (history, cookies, extensions, sync status)
- System Triage: Network connections, processes, services, scheduled tasks, registry autoruns
- Structured Output: CSV/TXT artifacts, hashes, and a packaged final collection
- Low Friction: Intended for practical adoption by responders and analysts
The Pro workflow extends this model with advanced capabilities such as offline mounted-volume collection,
chain of custody outputs, executive reporting, and enhanced evidence packaging.
Installation Options
Owners
Copyright
(c) 2025 Jesus Angosto. All rights reserved.
Package Details
Author(s)
- Jesus Angosto
Tags
DFIR Forensics IncidentResponse Triage PowerShell Windows LiveResponse CommunityEdition
Functions
Show-Banner Show-Help WriteLog WriteHash Set-ArtifactVisible Ensure-AcquiredArtifactAccessible Get-RelativeChildPath Copy-LiveArtifactWithFallback Get-BrowserProcessNames Add-BrowserProcessAction Invoke-BrowserCollectionPreparation Add-PacketCaptureFilters New-PacketCaptureOutputEntry Convert-ToTimelineTimestamp New-ChronosTimelineEvent Add-ChronosTimelineEvent Add-TimelineFileArtifactEvents Add-NexusLiteNode Add-NexusLiteEdge Get-NetworkInfo Invoke-PacketCapture Get-SmbInfo Get-Autoruns Get-ScheduledTasksInfo Get-FirewallRules Get-ProcessAndHashes Print-ProcessTree Get-Tree Get-USBHistory Get-Evtx PowerShell_Commands Get-LocalGroups Get-EnvVars Get-Services Get-ClipboardContent RecentFiles ActivitiesCache CopyPrefetch RecycleBin Get-DNS Installed_Software Collect-BrowserArtifacts Get-RdpConnections Get-SystemConfig Export-ForensicArtifactsFromVSS Get-CloudStorageArtifacts Get-RemoteAccessArtifacts Get-EmailArtifacts Export-ChronosTimeline Export-NexusLite Import-CsvSafe Test-HighRiskPath Test-SuspiciousCommand Get-ExecutablePathCandidate New-ForensicFinding Export-ForensicFindings Export-ExecutiveReport Export-ForensicCatalog Zip-Results
Dependencies
This script has no dependencies.
Release Notes
Default execution now runs the full CE workflow without interactive prompts, aligns output-directory behavior with unattended use, and improves browser profile collection plus Chronos timeline compatibility.
FileList
- PowerTriage.nuspec
- PowerTriage.ps1