Awesome Open Source
Awesome Open Source


The current scope of Invoke-LiveResponse is a live response tool for targeted collection. There are two main modes of use in Invoke-LiveResponse and both are configured by a variety of command line switches.


  • Reflectively loads Powerforensics onto target machine to enable raw disk access.
  • Leverages a scriptblock for each configured function of the script.
  • Common forensic artefacts and custom file collections.
  • WinPMem for memory support
  • Depending on the selected switches, each selected capability is joined at run time to build the scriptblock relevant to usecase.

Live Response

  • Inspired by the Kansa Framework, LiveResponse mode will execute any Powershell scripts placed inside a content folder.
  • Results consist of the standard out from the executed content.
  • The benefit of this method is the ability to operationalise new capability easily by dropping in new content with desired StdOut.

Can be run:

  • Over WinRM (original use)
  • Locally by leveraging the -WriteScriptBlock -LocalOut:$True switches to build a local collection script.
  • Invoke-LiveResponse supports Powershell 2.0 targets and above (excluding custom content)


Download Invoke-LiveResponse and extract into Powershell profile.

To run: Import-Module Invoke-LiveResponse

Help: Get-Help Invoke-LiveResponse -detailed

One liner install (if you trust me...)

PS> $url="";[Net.ServicePointManager]::SecurityProtocol = "tls12, tls11, tls";$WebClient=(New-Object System.Net.WebClient);$WebClient.Proxy=[System.Net.WebRequest]::GetSystemWebProxy();$WebClient.Proxy.Credentials=[System.Net.CredentialCache]::DefaultNetworkCredentials;Invoke-Expression $WebClient.DownloadString($url)


Get A Weekly Email With Trending Projects For These Topics
No Spam. Unsubscribe easily at any time.
powershell (1,346
dfir (75
forensics (72
incident-response (71