Skip to the main content.


Your Forever Free Digital Evidence Collector from Binalyze.


Binalyze ACQUIRE
Evidence Collector

favicon-acquire-binalyze-blueAdd the fastest and most comprehensive digital evidence collector to your toolkit today.



Binalyze ACQUIRE is our standalone evidence collector for traditional DFIR situations.

Like all Binalyze products, ACQUIRE is built on our proprietary IREC engine and offers the fastest and most comprehensive digital evidence collection on the market.

Forever FREE! No time limits usage. Use ACQUIRE to collect digital evidence for free as many times as you want.

Looking for remote capabilities? Binalyze AIR has all the same evidence collection capabilities from a central management console.

free digital evidence collection
Providing Cyber Resilience to World-class Enterprises Globally
logo-customers-pwc logo-customers-garmin logo-customers-sophos logo-customers-thy logo-customers-kpmg logo-customers-ey logo-customers-deloitte logo-customers-turkcell logo-customers-integrity360

Lightning Fast

At Binalyze we are obsessed with making evidence collection lightning fast. So far we got under 10 minutes, with more to come! Collect more than 40 evidence types and artifacts you need with a single mouse click.

Fast and free digital evidence collection

40+ Evidence Types

Don't trade speed for completeness. We collect over 40+ different types of digital forensic evidence remotely, including RAM image.

Want even more? Check out TACTICAL.

Collect 40+ types of digital evidence for FREE

Ransomware Shield

Don't let ransomware interfere with the evidence collection process.

Ransomware SHIELD is a kernel-mode driver that is monitoring collected evidence against any type of ransomware modification thus giving you the possibility to continue collecting evidence in a safe mode.

digital evidence ransomware protection

We collect more than 40 different types of system evidence in the following categories.

  • Disk Evidence

  • Memory Evidence

  • Browser Evidence

  • Registry Evidence

  • Network Evidence

  • Event Logs Evidence

  • Process Execution Evidence

  • Miscellaneous Evidence

AIR Evidence List


We collect various system artifacts in the following categories.

  • Server Artifacts

  • Microsoft App Artifacts

  • Communications Artifacts

  • Social Artifacts

  • Productivity Artifacts

  • Utility Artifacts

  • Developer Tools Artifacts

  • Cloud Artifacts

System Artifacts List


In addition to the 40+ evidence types collected, a custom content profile (path/pattern-based) can be defined for specific evidence requirements.

digital evidence list