> For the complete documentation index, see [llms.txt](https://notes.nomanaziz.me/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.nomanaziz.me/cybersecurity/blue-teaming/digital-forensics-and-incidence-response/data-and-memory-collection-with-fireeye-redline.md).

# Data and Memory Collection with FireEye Redline

### Introduction

* Redline is free endpoint security tool for **windows**
* used to collect data from compromised system
* typically used to collect
  * all running processes from memory
  * drivers from memory
  * file system metadata
  * registry data
  * event logs
  * browser history
  * much more

***