Why you should use IREC?
Collect critical evidence with a single mouse-click
RAM Image, $MFT, Event Logs, Registry Hives and much moreDETECT ENCRYPTED SYSTEM VOLUMES INSTANTLY
Software agnostic drive encryption detectionTRIAGE with YARA
Find the smoking gun in minutesENJOY THE SPEED
Literally the FASTEST evidence collector everDONGLE ACTIVATED
Does not require internet connection for activation
| Features | IREC TACTICAL | IREC Free |
|---|---|---|
| Instant drive/volume encryption detection | ||
| Calculate hash value of collected evidence (MD5, SHA1, SHA256) | ||
| Unlimited TRIAGE Scripts | ||
| - Search for processes | ||
| - Search in RAM | ||
| - Search in FileSystem (file name, extension, hash, datetime) | ||
| SIT - Suspected Incident Time | ||
| HTML and JSON report | ||
| Collect WMI Scripts used by Fileless Malware |