thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Advanced

Triage Collection

Rapid acquisition of high-value forensic artifacts from a system instead of a full disk image.

Definition

Triage tools such as KAPE, Velociraptor and CyLR collect event logs, registry hives, prefetch, browser data and other key artifacts in minutes, enabling fast analysis across many hosts. Full imaging may follow for critical systems.

Example

Running KAPE on 50 hosts to collect event logs and registry hives for parsing.

Exam tip

Triage collection trades completeness for speed during large-scale incidents.

Related terms