As ever, VR is an awesome project, please keep up the amazing work.
Having said that, I did come across a possible bug with the offline collector.
Summary: the offline collector (using Windows.Triage.Targets) seems to ignore the MaxFileSize specified in the collector configuration.
To replicate:
- Configure a new collector:
- Select
Windows.Triage.Targets (imported)
- Configure the
HighLevelTargets to use _LIVE
- Configure the
MaxFileSize to 104857600 (100MB - note: this should be the default - but either specifying it or leaving it blank appears to give the same result).
- Create the new collector.
- Run the new collector.
- Check the collection zip for the vhdx file and check the log file.
In our example, there is a 260MB vhdx file that gets collected by the _LIVE high-level target, presumably because it was recently mounted. The 260MB file gets collected, even though the max file size is set to 100MB.
In the log you can see that it recognises that the file collected is larger:
[INFO] 2026-06-16T01:02:03Z Collecting file C:\Temp\Test.vhdx into /uploads/auto/C%3A/Temp/Test.vhdx (272629760 bytes)
Context: this was an issue for me in a real collection, as there was a 300+GB VHDX file that the collector tried to collect. It ultimately caused the collection to fail as it hit the time limit and would've exceeded the size USB drive being used to collect from the network isolated device. I worked around it by not using _LIVE but this was a shame as it collects some really useful things.
Screenshots:
As ever, VR is an awesome project, please keep up the amazing work.
Having said that, I did come across a possible bug with the offline collector.
Summary: the offline collector (using
Windows.Triage.Targets) seems to ignore theMaxFileSizespecified in the collector configuration.To replicate:
Windows.Triage.Targets(imported)HighLevelTargetsto use_LIVEMaxFileSizeto104857600(100MB - note: this should be the default - but either specifying it or leaving it blank appears to give the same result).In our example, there is a 260MB
vhdxfile that gets collected by the_LIVEhigh-level target, presumably because it was recently mounted. The 260MB file gets collected, even though the max file size is set to 100MB.In the log you can see that it recognises that the file collected is larger:
[INFO] 2026-06-16T01:02:03Z Collecting file C:\Temp\Test.vhdx into /uploads/auto/C%3A/Temp/Test.vhdx (272629760 bytes)Context: this was an issue for me in a real collection, as there was a 300+GB VHDX file that the collector tried to collect. It ultimately caused the collection to fail as it hit the time limit and would've exceeded the size USB drive being used to collect from the network isolated device. I worked around it by not using
_LIVEbut this was a shame as it collects some really useful things.Screenshots: