Collector changelog

Changes to evidence coverage, platform support, and how collectors are delivered.

Updates are tracked by date. The Velociraptor version identifies the engine; it does not identify every change to this collector.

14 dated updates

Not yet released1 proposal under review

These changes are not in the current downloads.

Not yet released
ProposedWindows

Parsed Windows evidence and download attribution

  • Add parsed SRUM, BAM, UserAssist, AppCompatCache, and Amcache results alongside the raw evidence already collected.
  • Preserve raw Zone.Identifier streams under user profiles, with a 20-directory recursion limit and a 64 KiB per-stream size selection limit. The stream's parent file is not acquired by this pass.
  • Hosted Windows tests found small warm-run parser overhead; first-collection timings varied substantially between runners. Workstation impact remains workload-dependent. Broader staging-file acquisition and ListSync/Search exclusions are separate follow-ups awaiting upstream support.
Issue #20PR #23 (open)

2026

AddedWindowsLinux

Validate Windows and Linux collections before publication

  • Run the production Windows and Linux collectors on disposable CI runners and validate ZIP integrity, completed collection metadata, meaningful artifact results, and acquired file bytes before publishing a release.
  • Require both runtime checks to pass and match the published Windows and Linux executables to the tested binaries by SHA256. Collection errors and incomplete evidence can block publication even when the collector exits successfully.
  • Report narrowly verified non-file and temporary-file skips separately. Unexpected errors, partial uploads, and missing evidence still block publication.
  • Keep collected evidence, raw logs, and source-path facts on the disposable runners. Retain only redacted validation summaries for three days.
PR #21First validated publication
Breaking changeWindowsLinuxmacOS

Windows x86 retired; builds support Velociraptor 0.77.3

  • Remove the 32-bit Windows collector because Velociraptor 0.77.3 removed the Windows_x86 build target. Windows downloads now require x64; Linux x64 and both macOS architectures remain available.
  • Support compressed upstream binaries and keep macOS binaries on the same engine version as the build host. Invalid downloads and fatal artifact errors stop the build; upstream advisory warnings remain nonfatal.
  • Rebuild collectors when their inputs change. Site-only changes no longer replace the download, and release metadata is committed after publication succeeds.
PR #19
FixedWindowsLinuxmacOS

macOS launch fix and more reliable downloads

  • Ad-hoc sign both macOS collectors after embedding their configuration, fixing launch failures caused by invalidated signatures on modern macOS. This is not Apple notarization; trusted browser downloads can still need their quarantine flag cleared.
  • Tolerate harmless CDN timestamp differences while retaining checks for changed download content, reducing interrupted builds caused by inconsistent CDN metadata.
PR #18: macOS signingPR #16: CDN handling
AddedWindowsLinuxmacOS

Linux and macOS collectors added

  • Add Linux x64, macOS Intel, and macOS Apple Silicon downloads using Linux.Triage.UAC with all applicable targets selected.
  • Embed the matching macOS executable so each macOS download is a standalone collector instead of a shell stub that requires another binary.
  • Check every output's format and minimum size before publication to reject collector stubs.
PR #14: platform supportPR #15: standalone binaries
AddedWindows

32-bit Windows support added

  • Add a Windows x86 collector alongside the existing x64 download, using the same collection targets. A failed x86 build blocks publication of a partial release.
  • This historical download was later retired on October 6, 2026.
PR #12
ChangedWindows

Target changes trigger fresh collector builds

  • Detect updates to Windows.Triage.Targets and rebuild even when the Velociraptor engine version is unchanged. Evidence coverage can therefore evolve between builds that share an engine version.
  • Display the last build time on the site and record the target bundle's hash alongside the engine version. Validate artifact definitions before building.
PR #11

2025

FixedWindows

Fix serialization of Windows target selection

  • Encode the selected KAPE Triage, Basic Collection, Live, and SANS Triage groups in the JSON-array format expected by the artifact. This corrects the configuration errors following the target-selection update.
PR #7PR #9
ChangedWindows

Update Windows collection groups and include Live

  • Replace the legacy individual target switches, including ServerTriage, with HighLevelTargets selecting KAPE Triage, Basic Collection, Live, and SANS Triage.
  • The new selection includes live system and adaptive evidence collection. Its configuration serialization was corrected on October 28.
PR #6
FixedWindows

Restore the three-day shadow-copy setting

  • Use the renamed VSS_MAX_AGE_DAYS parameter after migrating to Windows.Triage.Targets, restoring the intended acquisition of available Volume Shadow Copies up to three days old.
PR #4
ChangedWindows

Move to the separately maintained triage artifact

  • Switch from Windows.KapeFiles.Targets to Windows.Triage.Targets and download its definitions from the upstream Triage Artifact project during builds. The collection definitions can now change independently of the engine binary.
PR #2
FixedWindows

More resilient collector builds

  • Retry upstream API requests and binary downloads, clean up partial downloads, and reject empty or invalid release responses. Transient network failures are less likely to interrupt collector updates.
Source change
AddedWindows

Initial Windows triage collector

  • Introduce the Windows x64 offline collector with KAPE/SANS triage targets, Basic Collection, ServerTriage, and Sysinternals Autoruns, with a three-day shadow-copy acquisition setting.
  • Run with administrative privileges and write a local Triage-<host>-<timestamp> ZIP containing JSONL results and acquired evidence. ZIP output is unencrypted.
Initial commit