<img height="1" width="1" style="display:none;" alt="" src="https://px.ads.linkedin.com/collect/?pid=3026858&amp;fmt=gif">


Your Forever Free Digital Evidence Collector from Binalyze.


Binalyze ACQUIRE
Evidence Collector

favicon-acquire-binalyze-blueAdd the fastest and most comprehensive digital evidence collector to your toolkit today.



Binalyze ACQUIRE is our standalone evidence collector for traditional DFIR situations.

Like all Binalyze products, ACQUIRE is built on our proprietary IREC engine and offers the fastest and most comprehensive digital evidence collection on the market.

Forever FREE! No time limits usage. Use ACQUIRE to collect digital evidence for free as many times as you want.

Looking for remote capabilities? Binalyze AIR has all the same evidence collection capabilities from a central management console.

free digital evidence collection
Providing Cyber Resilience to World-class Enterprises Globally
PwC Garmin Sophos Turkish Airlines KPMG EY Deloitte Turkcell Integrity360

Lightning Fast

At Binalyze we are obsessed with making evidence collection lightning fast. So far we got under 10 minutes, with more to come! Collect more than 40 evidence types and artifacts you need with a single mouse click.

Fast and free digital evidence collection

40+ Evidence Types

Don't trade speed for completeness. We collect over 40+ different types of digital forensic evidence remotely, including RAM image.

Want even more? Check out TACTICAL.

Collect 40+ types of digital evidence for FREE

Ransomware Shield

Don't let ransomware interfere with the evidence collection process.

Ransomware SHIELD is a kernel-mode driver that is monitoring collected evidence against any type of ransomware modification thus giving you the possibility to continue collecting evidence in a safe mode.

digital evidence ransomware protection

We collect more than 80 different types of system evidence in the following categories.

  • Disk Evidence

  • Memory Evidence

  • Browser Evidence

  • NTFS Evidence

  • Registry Evidence

  • Network Evidence

  • Event Logs Evidence

  • WMI Evidence

  • Process Execution Evidence

  • Miscellaneous Evidence

AIR Evidence List


We collect over 70 different system artifacts in the following categories.

  • Server Artifacts

  • Microsoft App Artifacts

  • Communications Artifacts

  • Social Artifacts

  • Productivity Artifacts

  • Utility Artifacts

  • Developer Tools Artifacts

  • Cloud Artifacts

System Artifacts List


In addition to the 150+ evidence types collected, custom content profiles (path/pattern based) can be defined for specific evidence requirements.

digital evidence list