Offline-first
Core evidence processing is designed to run on the analyst workstation.
TVAK Security
TVAK Collector for Windows available · TVAK Analyst in development
Evidence in.
Clarity out.
Collect Windows forensic evidence and move through an evidence-led, offline-first investigation workflow built to keep analyst judgment in control.
Offline-first by designEvidence under analyst controlHuman-led, AI-assisted
Acquire only what matters.
Selected evidence flows from endpoints through Collector into a structured package.
EndpointWKSTN-07
EndpointLAPTOP-12
EndpointSRV-03
TVAK Collector
Processes✓
Event Logs✓
Registry✓
Files✓
Evidence PackageStructured output
WINDOWS · AVAILABLEBuilt for consequential work
Evidence, privacy, and clarity by design.
TVAK Security is building privacy-conscious investigation tools for incident responders, forensic investigators, threat hunters, and enterprise security teams.
Evidence-led
Findings stay connected to source artifacts, rules, and confidence.
Transparent
Proven links and contextual associations remain visibly distinct.
Human-led
AI can assist reasoning and reporting without replacing analyst judgment.
One evidence-led workflow
From collection to a defensible report.
Collector is available for Windows. Every Analyst stage below is a clearly labelled concept for a product still in development.
01 / Evidence Acquisition
Collect
Use the guided GUI or scriptable CLI to collect selected endpoint artifacts into a structured, hash-manifested package.
Available · Open Source · Windows
Linux · In Development
- Select modules
- Run acquisition
- Hash/package evidence
02 / Planned Investigation
Import
The planned investigation workspace begins with evidence collected away from the analysis environment.
Bring a structured evidence package into the case.
03 / Planned Investigation
Triage
The planned workflow keeps findings tied to their source artifacts, rules, and confidence for analyst review.
Prioritise findings with evidence context.
04 / Planned Investigation
Reconstruct
The planned timeline workflow aligns related events while preserving their source and investigation context.
Reconstruct activity across forensic sources.
05 / Planned Investigation
Connect
The planned relationship view distinguishes proven links from contextual associations.
Connect artifacts without overstating causality.
06 / Planned Investigation
Investigate
Planned assistance supports review, hypotheses, and next steps without replacing human decisions.
Keep investigative judgment with the analyst.
07 / Planned Investigation
Report
The planned reporting workflow keeps conclusions connected to technical findings and evidence references.
Build a defensible account of the case.
Primary products
Two focused tools.
One investigation path.
Collector acquires selected Windows evidence today. Analyst is the planned offline investigation workspace and remains in development.
01 / PRIMARY PRODUCT
Available · Open Source · Windows
TVAK / Collector
TVAK Evidence Collector for Windows
A lightweight Windows forensic evidence and artifact acquisition tool for collecting selected endpoint artifacts and creating structured evidence packages without requiring a permanently installed endpoint agent.
Windows release available now. Linux support is in development.
- Open source
- GUI + CLI
- Selective collection
- Evidence packaging
- VSS-aware acquisition
- Integrity metadata
- Optional memory
02 / PRIMARY PRODUCT
In Development
TVAK / Analyst
TVAK Analyst
An offline-first DFIR investigation workspace for triage, evidence review, timeline reconstruction, artifact relationships, assisted investigation, and reporting.
Concept preview only · Product in development
- Triage findings
- Timeline Explorer
- Evidence Explorer
- Artifact Graph
- AI Investigation
- Reporting
Capability context
Technical detail,
without the noise.
Select a capability to see how it fits TVAK's acquisition and planned investigation model.
CAPABILITY / 01
Selective acquisition
Choose the Windows evidence modules relevant to the investigation instead of relying on a permanent endpoint agent.
Architecture & privacy
Evidence stays close.
Control stays with you.
Core evidence processing is designed to occur locally by default. External services, including AI APIs, remain optional and must be explicitly configured.
- Investigation engine runs on the analyst workstation
- Evidence is not automatically uploaded externally
- Local models and external APIs remain clearly distinguished
01Evidence sourceSelected Windows artifacts
→02TVAK packageManifest, hashes, collection log
→03Local AnalystPlanned investigation workspace
ORGANISATION-CONTROLLED BOUNDARY
Future product direction
Roadmap products,
clearly distinguished.
These concepts describe future direction. They are not currently available for download or production use.
03 / FUTURE PRODUCT
Planned
TVAK / Intelligence
TVAK Threat Intelligence
A threat intelligence operating environment centered on context, actionability, and investigation workflows.
- IOC workflows
- Campaign context
- Detection content
04 / FUTURE PRODUCT
Future Roadmap
TVAK / Live Response
TVAK Live Response
A future extension for controlled remote collection, endpoint triage, and case-based response workflows.
- Remote triage
- Artifact acquisition
- Secure sessions
Resources
Practical guidance for better investigations.
Resource categories are being prepared. No placeholder below is presented as a published article.
DFIR Guides
Building a Defensible Incident Timeline
Coming soonIncident Response
Why Artifact Correlation Matters in DFIR
Coming soonWindows Forensics
Evidence Collection Without a Permanent Agent
Coming soonThreat Hunting
Transparent Findings for Threat Hunters
Coming soonProduct Updates
Inside the TVAK Investigation Workflow
Coming soonClear answers
Frequently asked questions.
What enterprise security teams should know about TVAK’s current direction and product status.
01Is TVAK available today?+
TVAK Evidence Collector for Windows is available now as an open-source download. Linux support and TVAK Analyst remain in development, while other platform capabilities are planned or on the future roadmap.
02Is TVAK cloud-based?+
TVAK is being designed as an offline-first platform. Core investigation and evidence processing are intended to run locally by default.
03Does TVAK upload evidence externally?+
Not by default. External services should only be used when an organization explicitly configures them.
04Does TVAK replace an EDR or SIEM?+
No. TVAK is intended to complement endpoint, SIEM, and security monitoring platforms through evidence collection, correlation, and forensic analysis.
05Is TVAK an autonomous AI investigator?+
No. AI capabilities are intended to assist with summaries, correlation, hypotheses, and reporting while keeping decisions under analyst control.
06Can TVAK work in restricted environments?+
The platform is being designed with offline and isolated investigation environments in mind.
Contact & Analyst early access
Bring clarity to your next investigation.
TVAK Evidence Collector for Windows is available now. TVAK Analyst remains in development. Contact us about Analyst early access, future products, or general enquiries.