● Latest release v0.11.0 / Apache-2.0

Find the shadow.

Every intrusion leaves one — in the $MFT, in registry hives, in event logs the operating system is still holding open. Aralez reads NTFS and EXT4 directly from the raw volume, so those artifacts are acquired intact, stream into an encrypted archive, and survive an interrupted run.

Download for Windows Quick start

Filesystems: NTFS · EXT4 · POSIX
Artifact paths: 262 shipped
Binary: Single, static
Config: Embedded

Aralez / \\.\C: Collecting

Volume: NTFS · 931.5 GB
Mode: Stream · deflate
Access: Raw · sector

Deflate 0%

Aralez_DC01_2026-08-14_09-12-04.zip AES-256 0 B

Disk footprint: 1×Streaming compression writes one archive instead of a folder you zip afterwards.
Archive formats: 2AES-256 ZIP, or .tar.zst that stays readable if the process dies.
Delivery targets: 4S3 and S3-compatible, SFTP, SMB, or any local and UNC path.
Deployment vectors: 8SSH, WinRM, PsExec, Ansible, SCCM/Intune, GPO, BITS, Puppet.

01 — Raw volume access

The file API is the problem. So Aralez doesn't use it.

Every triage tool that opens SYSTEM through CreateFile loses to the lock Windows already holds. Aralez opens the volume itself and parses the on-disk structures, which is why the hard artifacts come back intact.

\\.\C:: Raw volume handles. NTFS is parsed directly from the device, so $MFT, $UsnJrnl, SAM, SYSTEM and open .evtx files are read while Windows holds exclusive locks on them. On Linux the same applies to EXT4, with an automatic POSIX fallback when a filesystem is missing journal features or reports as corrupt.
SectorReader: 4096-byte aligned I/O. Raw partition handles on Windows only accept sector-aligned reads and seeks, so Aralez aligns down, over-reads to the next boundary and slices out the requested window transparently.
.FileSlack: Slack space is preserved separately. Aralez decodes the Valid Data Length from the raw $DATA attribute header. Bytes between VDL and allocated size are written to a separate .FileSlack entry while the main file is zero-padded — so the recovered file stays byte-accurate and the slack survives for analysis.
filename:stream: Alternate Data Streams. Collection patterns accept an ADS suffix. Streams are written as <file>_<stream>, all-zero chunks are skipped, and $INDEX_ALLOCATION attributes are extracted as .idx entries.
8.3 dedup: No duplicate short names. Directory entries are sorted so DOS-namespace entries sort last, then deduplicated by file record number. You get Program Files, not a second PROGRA~1.

02 — Zero-folder streaming

Compress while you collect, not after.

The classic pattern writes every artifact to a staging folder, zips it, then deletes the folder — so peak disk use is roughly twice what you collected. Aralez pipes each file through the compressor as it reads it.

Folder mode

Peak ≈ 2×

Staged1.24 GB

Archive412 MB

Peak1.65 GB

Artifacts land on the endpoint's disk before they are compressed, and stay there until the archive completes.

Stream mode `--stream`

Peak ≈ 1×

Staged—

Archive412 MB

Peak412 MB

Readers write through an OutputTarget that is either a file, a ZIP entry or a TAR entry — the collection code is identical either way. Bytes move in 4 KB chunks, so memory stays flat regardless of artifact size.

ZIP

AES-256, ZIP64, streamed

Entries are written sequentially through a single deflate stream. -e applies WinZip AES-256 to the archive. ZIP64 is on, so there is no 4 GB ceiling.

TAR.ZST

Crash-resilient by construction

A .tar.zst is a run of independently decodable frames. Kill the process mid-write and everything already flushed is still recoverable — a truncated ZIP loses its central directory.

Note

Archive encryption applies to the ZIP path only. Combining -e with --compression tar produces an unencrypted .tar.zst. Use ZIP when the archive must be encrypted at rest.

03 — Interrupt safety

Ctrl+C is a supported exit, not a lost run.

The first interrupt sets a flag that is checked between tasks and inside the NTFS and EXT4 directory walks, so the abort lands within a file rather than a task. The run then appends its log, closes the archive properly and exits with a valid, fully readable result containing everything collected up to that moment.

A second Ctrl+C force-quits.

Interrupt sequence

$ sudo ./aralez --stream
  collecting  /var/log/journal/…        84.2 MB
  collecting  /etc/shadow                 1.1 KB
^C
  Finalizing archive… (press Ctrl+C again to force quit)
  + collection log appended
  + central directory written
  ✓ Aralez_web01_2026-08-14_09-12-04.zip  ·  412 MB

04 — Coverage

What comes back.

The shipped profiles define 262 artifact paths. Beyond files, Aralez captures live system state through built-in collectors that need no external binaries.

$MFT · $Boot

Master file table and boot sector, read raw

$Extend\$UsnJrnl

USN change journal and $ObjId

Registry hives

SAM, SYSTEM, SOFTWARE, SECURITY, DEFAULT

User hives

NTUSER.DAT and UsrClass.dat per profile

*.evtx

Windows event logs, collected while open

Prefetch

*.pf execution evidence

Amcache

*.hve program execution records

Scheduled tasks

Task definitions and registration

*.lnk · Jump Lists

Recent, Custom and AutomaticDestinations

PowerShell history

PSReadline console history

WMI

OBJECTS.DATA and *.etl trace logs

BITS

Background transfer queue database

Browser history

Edge, Chrome and INetCache

$Recycle.Bin

Deleted file records

WER reports

ReportArchive and ReportQueue

Firewall logs

pfirewall.log

Shell history

Root and per-user history and rc files

SSH material

authorized_keys, known_hosts, private keys

/var/log

auth.log, syslog, wtmp, btmp, journal

Persistence

cron, systemd units, rc*.d, autostart

auditd

Rules and audit configuration

Accounts

passwd, group, shadow, sudoers

Service configs

sshd, nginx, apache2, httpd

Containers

cgroup, docker and containerd artifacts

Cloud credentials

.aws, .kube, .docker configuration

Temp surfaces

/tmp, /var/tmp, /dev/shm

ProcDetailsInfo

Per-process MD5 and SHA-256, modules, threads

Injection heuristic

RWX thread start addresses, Shannon entropy > 7.5

Hidden processes

ps output diffed against /proc entries

Network state

TCP tables decoded without shelling out

Kernel modules

Loaded modules with address and size

Package inventory

dpkg and rpm databases, repo sources

Sysinternals

autorunsc, handle, pslist, listdlls, pipelist

Suspicious samples

Encrypted in transit past AV gateways

05 — Under the hood

Collection that reacts to what it finds.

link:

Evidence-driven chaining

An execute task can pipe its stdout into a collect task. The shipped Windows profile extracts ImagePath from Event ID 7045 — new service installed — and then collects every one of those binaries automatically.

Job Objects

Nothing escapes a timeout

Child processes run inside a Windows Job Object with kill-on-close and a memory cap; on POSIX each gets its own process group. A timeout terminates the whole tree, not just the process that was launched.

Guardrails

Never fills the disk

Free RAM and free disk are checked before the run and re-checked before every task. Tool output is capped byte-exactly. If headroom drops below the limit, collection stops and the archive still finalizes.

Embedded

One file to deploy

The YAML config lives inside the executable — a PE resource on Windows, byte markers appended to the ELF or Mach-O elsewhere. -c writes a new binary with a new config baked in. No sidecar files reach the endpoint.

Static

No runtime dependencies

Windows MSVC builds link the CRT statically and carry a requireAdministrator manifest, so there is no VC++ redistributable to chase and elevation is automatic.

Rayon

Parallel tool execution

Execute tasks fan out across cores with nested parallel iteration over both entry groups and individual executors.

06 — Platforms

Where it runs, and how it reads.

Platform support, filesystem access method and release status
Platform	Access method	Privilege	Status
Windows	Raw NTFS volume parsing · \\.\C:	Administrator	Published binary
Linux	Raw EXT4 parsing, POSIX fallback · /dev/sdX	root	Published binary
macOS	POSIX walker · SIP blocks raw device access	root + Full Disk Access	New in v0.11.0

Scope

APFS and HFS+ are detected but not parsed. macOS collection runs through the POSIX walker, which is the practical ceiling anyway since System Integrity Protection blocks raw /dev/diskXsY access — so the locked-file advantage described above applies to Windows and Linux, not macOS.

The shipped macOS profile targets Monterey through Sequoia and is scoped to attack artifacts: unified logs, FSEvents, KnowledgeC, TCC, quarantine, LaunchAgents and persistence. Live state covers processes and process detail; the memory, network and package collectors are Linux-only.

07 — Delivery

Evidence leaves the endpoint on its own.

Point -o at a destination and the archive ships straight from the host. After a successful remote transfer the local copy is removed.

S3 · MinIOstreamed put_object

SFTP8 MB chunks

SMBshare or UNC path

Folderlocal or mounted

Routing examples

# Ship to an SFTP collector
sudo ./aralez --stream -o sftp://forensic@collector.corp/incoming

# Ship to S3
sudo ./aralez --stream -o s3://forensic-bucket/evidence/

# Ship to a MinIO instance
sudo ./aralez -o s3://bucket/prefix \
  --s3-endpoint https://minio.internal:9000

# Silent run to an SMB share, for SCCM or GPO
aralez.exe --stream --silent -o smb://fileserver/forensics/incoming

08 — Deployment

Use the control plane you already have.

Because the config is compiled into the binary, mass deployment is a file copy and an execute. Ready-made scripts ship in deploy/.

SSHparallel fan-out WinRMPowerShell push PsExecfallback path Ansibleplaybook SCCM · Intuneregistry detection GPOstartup script BITSresumes on drop Puppetrun-once guard

09 — Get Aralez

One binary. No installer.

Latest release v0.11.0, published 14 August 2026. Run as Administrator on Windows, or as root on Linux and macOS.

Windows

Static executable with an embedded administrator manifest. No VC++ redistributable.

aralez_x64_windows.exe 32-bit build →

Right-click → Run as administrator, or launch from an elevated prompt.

Linux

Single ELF binary. Raw EXT4 parsing with an automatic POSIX fallback.

aralez_x64_linux 32-bit build →

Run with sudo. Aralez exits immediately without root.

macOS

New in v0.11.0

Single Mach-O binary. Collection uses the POSIX walker — SIP blocks raw device access.

aralez_x64_mac Intel build · Rosetta 2 on Apple Silicon

Run with sudo, and grant Full Disk Access to your terminal — TCC-protected artifacts are skipped silently without it.

Make collection the part you don't worry about.

Read the quick start, or go straight to the CLI and configuration reference.

Quick start Documentation