Collect and manage forensic data

Single File

Collects a specific file from an endpoint to investigate a particular process or file.

Multiple Files

Gathers several files that match specific criteria, such as patterns, sizes, or locations, for broader data gathering.

Triage

Collects system-wide forensic data, such as running processes and network connections, for timeline analysis or incident response.

Standard Investigative Details

Captures endpoint system information, disk audits, volume details, and user accounts.

Process Memory

Acquires a full memory dump of a running process for detailed malware analysis.

Driver Memory

Collects memory from a specific system driver to investigate kernel-level threats

Raw Disk

Provides a raw disk image for comprehensive forensic review.

Command Shell History

Requests a record of command shell activity from Windows endpoints.

PowerShell History

Collects Windows event log data to track PowerShell activity on endpoints for security auditing and forensic investigations.

Full Memory

Uses the memory-acquisition audit to acquire physical memory from Windows endpoints for forensic analysis and threat investigation.

Comprehensive Investigative Details

Collects detailed forensic data from Windows, macOS, and Linux endpoints to support deep security analysis.

Quick File Listing

Requests file and directory records from Windows, macOS, and Linux endpoints for security auditing and investigative purposes.

File Name

Enter the name of the file to collect.

Path

Auto-filled. Displays the location where the file will be stored.

Collection Type

Select RAW (recommended) or API.

Comment

(Optional) Add a note about the collection.

Path

Enter the full storage path.

Regex Path Filter

(Optional) Use regex to filter target files within the specified path.

Depth

Specify folder depth to include in the search.

Collection Type

Select RAW (recommended) or API.

File Hashes

Select the required type of file hashing.

Max File Size (bytes)

Set a maximum size. Files exceeding this limit won’t be collected.

Min File Size (bytes)

Set a minimum size. Files below this limit won’t be collected.

Content Regex

(Optional) Use regex to identify the file content to include.

Regex Condition

Choose OR (match any regex) or AND (match all).

Comment

(Optional) Add a note about the collection.

Comment

(Optional) Add a note about the collection.

PID

Enter the unique Process ID of the target process for memory acquisition.

Process Name

Enter the executable file name of the target process from which memory is acquired.

Comment

(Optional) Add a note about the collection.

Driver Name

Enter the file name of the target kernel-mode driver for memory acquisition.

Comment

(Optional) Add a note about the collection.

Path

Specify the system device path for the physical disk or volume targeted for acquisition.

Volume Name

Specify the logical volume identifier, such as a drive letter, for data acquisition.

Offset

Enter the starting byte position on the specified path or volume for data acquisition.

Size

Enter the total number of bytes to acquire, starting from the specified offset.

Comment

(Optional) Add a note about the collection.

Comment

Enter the reason you want to acquire the file and any details about the data acquisition request that you want to track.

Offset

Specify the offset, in bytes, from the beginning of physical memory from which full memory data should be acquired.

Size

Specify the size, in bytes, of full memory data to acquire.

Comment

Enter any details about your specific data acquisition request, and enter the reason you want to acquire the file.

Return

Select Files and directories to include both files and directories in the file listing. Select Just files to include only files in the file listing. Select Just directories to include only directories in the file listing.

Filter by path

Specify the path you want included in the file listing. Ensure that you enter a precise path name or an appropriate path-based Windows environment variable. For example, use the %systemdrive% variable instead of a specific drive letter like C:. Trellix EDRF expands the variable to the actual system drive path on the endpoint.

For network shares, specify files and folders using universal (or uniform) naming conventions (UNC). For more details, see https://msdn.microsoft.com/en-us/library/gg465305.aspx.

Do not specify drive letters or path names since different endpoints have different drive mappings.

If you explicitly specify a folder name, end the path with a backslash (for example, \\trellix.com\shared\).

Regex path filter

Use this option to filter using a Perl-compatible regular expression (regex) to specify the path you want to include in the file listing.

Include remote locations

Select this option to include all directories at remote locations in the file listing.

Note

This option is available for Linux and macOS operating systems.

Include all directory levels

Select this option to include all directory levels in the file listing.

Depth

If you did not select Include all directory levels, specify the folder depth that should be included in the file listing.

Minimum file size

Specify the minimum file size, in bytes, of files that should be included in the file listing.

Maximum file size

Specify the maximum file size, in bytes, of files that should be included in the file listing.

Content Regex

Specify Perl-compatible regular expressions (regex) to identify required file content for files included in the listing. Specify one regular expression per line.