Disconnected DFIR Triage with Velociraptor Offline Collector (No Agent / Network-Restricted)
Evidence collection and analysis using a pre-configured encrypted offline collector in environments where a Velociraptor agent cannot be installed or network access is restricted (isolated network, OT/ICS, field).
Prepare
5 steps- Collector creation
pre-incident — In Velociraptor GUI, create a collector for Windows AMD64 (and ARM64 if needed) via `Server Artifacts → Server.Utils.CreateCollector`; select artifacts `Windows.KapeFiles.Targets` (!SANS_Triage, FileSystem, RegistryHives), `Windows.System.Pslist`, `Windows.Network.NetstatEnriched`, `Windows.Forensics.Prefetch`, `Windows.Sys.StartupItems`; output format ZIP Archive; enable AES encryption with server X509 public key (available from v0.6.7+, supported in v0.76.x)
- Resource limits
During collector creation, set CPU limit to 50%, memory limit to 1 GB, and duration limit to 30 minutes; minimizes impact on the system in field environments
- Collector deployment readiness
Copy the generated `velociraptor-collector.exe` (~40–60 MB) to an exFAT-formatted USB or a write-only network share; confirm the architecture matches the target environment
- Encryption key management
The private key is kept only on the analysis workstation and by the secure team; the collector contains only the public key
- Zimmerman Tools and analysis environment
On the analysis workstation, update MFTECmd, PECmd, RECmd tools with `Get-ZimmermanTools.ps1 -NetVersion 6`; no Velociraptor server connection is required for offline analysis