BergssonForensics
Menu
THE BERGSSON WINDOWS TOOLS

A clearer way to collect.

Choose what matters, keep a record of your work, and leave with results you can review.

COLLECT THE RELEVANT RECORDS

Bergsson Forensics Collection Tool

Choose from 16 collection areas. Create a local case folder with copied records, a readable report, file hashes and an explicit record of collection gaps.

Download for Windows ↓

Version 1.0.0 · 150 KB · Windows x64

Check this download

Compare this SHA-256 value with the downloaded file:

f611c3a67afaf6400ffb74060fef4fa1b980b98b62b537196592290c3b4d1161

Get-FileHash .${f.file} -Algorithm SHA256

PREPARE YOUR TOOLKIT

Bergsson Forensic Download Tool

Choose from 19 Microsoft Sysinternals and Eric Zimmerman packages. Download from official publishers, unpack into a fresh toolkit and review hashes and signature results.

Download for Windows ↓

Version 1.0.0 · 123 KB · Windows x64

Check this download

Compare this SHA-256 value with the downloaded file:

6d1d1f4ac0fa87a6567a6bd1b25c13a9e7a4cad0e9c0d34b01997f789db03925

Get-FileHash .${f.file} -Algorithm SHA256

These first-release executables are unsigned. Windows may show an unknown-publisher prompt. Check the hashes and source before using them; keep Windows security enabled. They run on Windows 10/11 x64 with .NET Framework 4.8.

Start a collection

  1. Name the case and choose an output folder. Use a separate collection drive when practical.
  2. Choose the agreed sources. Select a row to read exactly what it collects. Some sources require “Run as administrator”.
  3. Collect, then open the report. Read failed/skipped items and verify SHA256SUMS.txt. A missing record does not prove the activity never happened.

Quick triage starts with system/clock information, running processes and a network snapshot. Additional choices include Prefetch, PCA, EVTX logs, registry activity keys, shortcuts and Jump Lists, Recycle Bin metadata, startup configuration, PowerShell, accessible Amcache/SRUM files, a bounded USN Journal sample, and selected game logs.

Understand the collection limits

This is a live triage collection. It does not create a forensic disk image, acquire RAM, recover locked files, or gather every artefact. Source reads and running the tool can leave new traces. Outputs stay local.

Event exports cover the last seven days. Registry exports do not retain key LastWrite timestamps. Amcache/SRUM files may be locked, and live database copies may be inconsistent. The USN sample covers a recent 32 MiB address range, at most 100,000 records / 60 seconds. Its API-buffer file is not a raw $J file for MFTECmd. The report records these limits and any failures.

Elevated sources have not all been validated in this environment. Test the tool on an approved lab system before relying on it in a case.

Download the tools you need

The downloader includes presets for a core screenshare toolkit, execution records, and file/user activity. It records each download and checks Windows Authenticode trust for EXE/DLL files. It does not run or install the downloaded programs.

Signature checks are offline and do not check revocation. Recorded SHA-256 values identify the downloaded bytes; they are not compared with independent publisher hashes. Unverified signatures and incomplete downloads are flagged in the inventory.

See all 19 publisher tools
  • Process Explorer — Inspect running processes and loaded modules. Windows 10/11
  • Autoruns — Review automatic startup entries. Windows 10/11
  • TCPView — Inspect active network connections. Windows 10/11
  • Sigcheck — Inspect file hashes, versions and signatures. Windows 10/11
  • Process Monitor — Capture future file, registry and process activity. Windows 10/11
  • Strings — Extract readable text from binary files. Windows 10/11
  • Handle — Inspect open file and object handles. Windows 10/11
  • Streams — List NTFS alternate data streams. Windows 10/11
  • PECmd — Parse collected Windows Prefetch files. .NET Framework 4.7.2+
  • AppCompatCacheParser — Parse AppCompatCache / Shimcache records. .NET Framework 4.7.2+
  • AmcacheParser — Parse Amcache inventory records. .NET 10 Desktop/runtime
  • EvtxECmd — Parse exported Windows event logs. .NET Framework 4.7.2+
  • MFTECmd — Parse MFT and supported NTFS metadata files. .NET Framework 4.7.2+
  • LECmd — Parse Windows shortcut files. .NET Framework 4.7.2+
  • JLECmd — Parse automatic and custom Jump Lists. .NET Framework 4.7.2+
  • RBCmd — Parse Recycle Bin metadata records. .NET Framework 4.7.2+
  • RECmd — Examine registry hives with supported plugins. .NET Framework 4.7.2+
  • SrumECmd — Parse collected SRUM resource-usage records. .NET Framework 4.7.2+
  • Timeline Explorer — Review and filter CSV timelines. .NET 10 Desktop/runtime

Official sources: Microsoft Sysinternals and Eric Zimmerman. Their licences apply. AmcacheParser and Timeline Explorer need Microsoft .NET 10; the GUI tool needs Desktop Runtime.

Source and release files

Download the C# source → · Full instructions and limits → · Release checksums →

Build with the Windows .NET Framework compiler. No API keys, account or internet connection are needed for local collection. The downloader needs internet access to the selected publishers.