All programs › Heirloom Evidence Triage
Incident response
Plug in the stick, type the case number, and click Start. Evidence Triage collects what an incident responder needs from a Windows computer - live activity, startup programs, logons, registry hives, and a hash and sector map of every file - without changing the computer it examines, and ends with a printable chain-of-custody report.
What it does
System time, network connections with the program behind each one, running processes, and who is logged on.
Scheduled tasks, startup programs and Run keys, services, drivers, and WMI subscriptions.
Successful and failed logons, account and policy changes, cleared logs, system errors, Remote Desktop, and PowerShell activity.
Raw copies read from the disk itself - including hives Windows keeps locked - with their .LOG files.
A full file listing with timestamps, SHA-256 and MD5, and each file's start sector, length, and fragments, plus a map of used and unused space.
Case number, examiner, UTC times, a hash manifest of everything collected, and a PDF report to print and sign.
A simple window for the bench, a command line for scripts, and a hidden background mode for scheduled runs.
Windows 7 through 11, from a USB stick or a desktop folder. A Linux version is included as a preview.
A sector self-check compares the disk read two ways, and every report records the tool's own hashes.
Price and download
Pay once, no subscription. The team license covers five examiners in the same organization.
Download link emailed after payment · Read the guide first (PDF)
For IT and security staff. Use only on computers your organization owns or you have written permission to examine - see the license agreement.
Runs on Windows 7, 8, 10, and 11 from a USB stick or any folder - nothing to install.
Questions
No. It only uses query commands, opens disks with read access, and reads file contents straight from the disk clusters, so no file's contents or last-access time change. Everything it writes goes to the evidence folder on your USB stick. Windows itself still records that a program ran and that a USB stick was plugged in - the guide lists what to note in your case file.
IT and security staff checking computers their organization owns or that they have written permission to examine. It is not for looking into anyone else's computer.
No - the guide is free to read before you buy, and we're glad to answer questions by phone. After payment the download link is emailed to you.
Five examiners in the same organization, for $399 once - about $80 each.
It's included as a preview. The Windows version is the one we've tested end to end.
No. Copy the folder to a USB stick (exFAT or NTFS) and double-click Heirloom Evidence Triage.
Needful Things Software is the home PC and personal finance line of Heirloom Software LLC of Williamsburg, Kentucky. Call or text (606) 521-7093 or email info@needfulthingssoftware.com - a real person answers.