Forensic triage,
from one executable.
Aralez is an Apache-2.0 forensic triage collector written in Rust. It acquires high-value live state and filesystem artifacts on Windows, Linux, and macOS, then produces a portable ZIP or TAR.ZST archive for downstream investigation.
This site covers Aralez v0.11.0, including its command line, configuration model, platform profiles, archive formats, delivery options, and deployment workflows.
What Aralez does
Acquire
Collect configured filesystem artifacts and run internal, operating-system, or embedded tools.
Preserve
Package artifacts with the exact embedded configuration and collection log, optionally with AES-256 ZIP encryption.
Deliver
Keep the archive locally or route it to a folder, SMB share, SFTP server, AWS S3, or an S3-compatible endpoint.
Where it fits
Aralez is a collector, not an evidence parser or case-management system. Use it during initial access and scoping, enterprise threat hunting, rapid endpoint acquisition, or targeted artifact preservation. Feed the resulting archive into your established forensic analysis workflow.
Platform model
| Target | Elevation | Filesystem path | Default configuration focus |
|---|---|---|---|
| ⊞ Windows | Administrator | NTFS reader + Windows APIs | MFT, Registry, EVTX, persistence, processes, network, Sysinternals |
| ⌁ Linux | root | Raw ext4 reader with automatic POSIX fallback | Shell/SSH, logs, auth, services, proc, containers, cloud configuration |
| ◉ macOS | root + Full Disk Access | POSIX walker — SIP blocks raw device access; APFS/HFS+ are detected but not parsed | Unified logs, FSEvents, TCC, persistence, browsers, XProtect, live state |
Operational characteristics
- ✓Single-file distribution. The YAML profile and, on Windows, selected external tools are embedded into the executable.
- ✓Ordered tasks. Lower numeric priorities run first; the templates capture volatile state before less time-sensitive files.
- ✓Bounded collection. Global and per-entry size limits, task timeouts, memory checks, and a disk-capacity threshold reduce endpoint impact.
- ✓Graceful first interrupt. Ctrl+C requests a stop and finalizes work collected so far; the second Ctrl+C forces termination.