Supported Evidence

These pages categorize the supported evidence and artifacts by OS, indicating whether each item is parsed and presented in the Investigation Hub and/or if the associated file is collected.

Windows CollectionsmacOS CollectionsLinux CollectionsIBM AIX CollectionsESXi Collections

The table below provides a count of the currently supported evidence and artefact items

Collection Type:	File Count
Windows artifact	119
Windows evidence	192
macOS artifact	27
macOS evidence	178
Linux artifact	25
Linux evidence	135
AIX artifact	7
AIX evidence	19
ESXi evidence	35
Grand Total	737