Supported Evidence

These pages categorize the supported evidence and artifacts by OS, indicating whether each item is parsed and presented in the Investigation Hub and/or if the associated file is collected.

Windows CollectionsmacOS CollectionsLinux CollectionsIBM AIX Collections

The table below provides a count of the currently supported evidence and artefact items

Collection Type:	File Count
Windows artifact	119
Windows evidence	191
macOS artifact	27
macOS evidence	175
Linux artifact	25
Linux evidence	135
AIX artifact	7
AIX evidence	19
Grand Total	698