Free tools Windows power users keep installed
One-click scans. No signup required.
UAC (Unix-like Artifacts Collector) is a portable, YAML-configurable shell tool that gathers selected live-response and forensic artifacts from Unix-like systems. Responders choose a profile, individual artifact definitions, or both, and specify a destination for the output. It is a collection utility—not a complete investigation or analysis suite—and what it gathers depends on the selected definitions and the target system.
What UAC collects—and what it does not
The UAC project describes the tool as an automated way to collect artifacts for incident response and forensic work. Its artifact rules can collect command output, copy files or directories, find matching paths, record hashes, and capture file metadata. The project’s README and Getting Started documentation describe those capabilities.
As an Amazon Associate I earn from qualifying purchases.
Collection is only one part of an investigation. UAC’s feature descriptions do not establish what happened on a host, prove that a collection is complete, or guarantee forensic soundness. The reviewed project materials also do not publish independent measurements of collection speed, success rate, completeness, or accuracy.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Which operating systems does UAC support?
The project lists nine operating-system labels: AIX, ESXi, FreeBSD, Linux, macOS, NetBSD, NetScaler, OpenBSD, and Solaris. The README says UAC is designed for diverse environments, including NAS and IoT devices; that describes intended reach, not a guarantee that a particular device or artifact will work.
#1 Best Overall
- Compact plug-and-stay design to instantly add storage to your laptop, game console, in-car audio, and more
- Save time with ultra-fast transfer speeds up to 400MB/s (Based on read speed. 1 MB/s = 1 million bytes per second. Based on internal testing; performance may vary depending upon host device, usage conditions, drive capacity, and other factors. USB 3.0 port required.)
- Transfer a full-length movie to the drive in less than 30 seconds (Based on 1.2GB MPEG-4 video transfer with USB 3.2 Gen 1 or USB 3.0 host device.)
- Get space for your high-resolution photos, videos, and more at a great value with up to 128GB of storage (1GB=1,000,000,000 bytes. Actual user storage less.)
- Password-protect files using a downloadable software (Password protection uses 128-bit AES encryption and is supported by Windows 10+ and macOS v10.9+ (Software download required, see Password Protection page on SanDisk site).)
UAC’s overall platform list is not a promise that every artifact runs on every listed system. Each YAML artifact rule declares its supported operating systems. Check the relevant supported_os entry and the target’s environment before selecting an artifact. The UAC source script also checks operating-system labels and exits for an unsupported label.
How UAC profiles and artifact rules work
UAC reads YAML artifact definitions dynamically. An artifact file has a version and a list of rules; each rule includes a description, supported operating systems, a collector type, and fields specific to that collector. A profile selects a collection set, while operators can also choose individual artifacts or custom YAML paths. Custom definitions make a collection adaptable, but they also determine exactly what is attempted.
Rank #2
- [Package Offer]: 5 Pack USB 2.0 Flash Drive 8GB Available in 5 different colors - Black Blue Green Red Silver. The different colors can help you to store different content.
- [Plug and Play]: No need to install any software, Just plug in and use it. The metal clip rotates 360° round the ABS plastic body which. The capless design can avoid lossing of cap, and providing efficient protection to the USB port.
- [Compatibilty and Interface]: Supports Windows 7 / 8 / 10 / Vista / XP / 2000 / ME / NT Linux and Mac OS. Compatible with USB 2.0 and below. High speed USB 2.0, LED Indicator - Transfer status at a glance.
- [Suitable for All Uses and Data]: Suitable for storing digital data for school, business or daily usage. Apply to data storage of music, photos, movies, software, and other files.
- [Warranty Policy]: 12-month warranty, our products are of good quality and we promise that any problem about the product within one year since you buy, it will be guaranteed for free.
The artifact reference documents five collector types:
| Collector | What it does | Important detail |
|---|---|---|
command |
Runs a defined command and saves its output. | Stdout goes to the configured output; stderr is logged to uac.log unless redirected. |
file |
Copies raw files and directories. | Copied files are placed in the collection’s output structure. |
find |
Locates matching files or directories. | Records paths rather than copying the matched content. |
hash |
Records hashes. | The algorithm is configured in the artifact rule. |
stat |
Collects metadata for a body file compatible with The Sleuth Kit. | Uses a Perl fallback if native stat is unavailable. |
Because a command rule executes on the target, not all collection is passive. The selected profile and artifact rules, available host utilities, permissions, and local configuration all affect what is collected.
Rank #3
- MOVE FILES IN A FLASH: Fast and convenient read speeds up to 300 MB/s* with the latest USB 3.1 standard give you more time to work, play, watch, and create; Send a 3GB 4K UHD video file from your Bar Plus to your PC in just 10 seconds**
- RUGGED REFINEMENT: As strong as it is stylish; The sturdy metal body keeps your data safe and intact, and the integrated keyring prevents accidental misplacement or loss; The Bar Plus is the ideal combination of stunning design and worry-free durability
- TOUGH & TRUSTED: The Bar Plus a trustworthy drive to store your valuable data; It works through it all with a waterproof, shock-proof, temperature-proof, magnet-proof, and X-ray-proof body, all backed by a 5-year limited warranty***
- WORLD'S #1 FLASH MEMORY BRAND: Experience the performance and reliability from the world's #1 brand for flash memory since 2003;**** All firmware & components, including Samsung's world-renowned DRAM & NAND, are produced in-house
How to run UAC for a collection
The project says UAC does not need to be installed on the target: download and extract it, then run the script. Its README gives these example invocations:
./uac -p ir_triage /tmpThis selects the ir_triage profile and uses /tmp as the destination. The project also shows selecting a memory artifact alongside the full profile:
Rank #4
- High Data Transfer Speed: USB 3.0 flash drive with read/write transfer speeds up to 80MB/s and 20MB/s respectively and it is backwards compatible with USB 2.0/1.1; Storage is fast, safe and stable
- Incredible Storage : USB flash drive with 16GB capacity, meet your needs of daily use on work, school, home and travelling for photos, music, videos, files storage and transfer
- Plug an Play : Just plug the flash drive then start data storage, backup and transfer between devices and locations; It supports Windows OS and compatible with PC, Laptop, TV, Car, Audio and etc
- Sleek and Practical Design : The 360 degree metal swivel cover provides extra protection for the 16gb usb drive. The end of the usb thumb drive has a loop that can easily be attached to your key chain or lanyard, using to help keep from losing, and for easy carrying
- What You Get : 16GB USB 3.0 Flash Drive; All of usb drives have been rigorously tested and formatted before leaving the factory
./uac -a ./artifacts/memory_dump/avml.yaml -p full /tmpThese are project examples, not a recommendation to run a broad profile in every incident. The README’s memory example documents a Linux collection method; it should not be read as universal memory acquisition across all platforms UAC lists.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitches- Choose the collection scope. Match a profile and any individual or custom artifacts to the incident and target. Inspect their YAML rules, including supported systems and commands.
- Prepare the destination. Select a directory with sufficient capacity and permissions for the expected output. UAC’s examples pass the destination as an argument; a portable drive is one possible destination in an authorized workflow, not a UAC requirement.
- Run the extracted script. Use the profile and artifact options appropriate to your selection, following the project’s command syntax and your organization’s procedures.
- Handle the output under your evidence procedures. UAC provides collection functionality; do not treat its use alone as a guarantee of chain of custody or evidence integrity.
How to choose a profile or individual artifacts
Start from the question the investigation needs to answer, then review what the chosen definitions actually collect. A named profile can provide a convenient selection, while individual artifacts or custom YAML rules offer more targeted control. Before execution, confirm that each rule applies to the target operating system and that any commands and dependencies it relies on are available. Avoid assuming that a profile gathers everything relevant or that custom rules behave identically across systems.
Best Value
- Ultra-compact and portable contoured styling
- Share your photos, videos, songs and other files between computers with ease
- Protect your private files with included SanDisk SecureAccess software (Password protection uses 128-bit AES encryption and is supported by Windows Vista, Windows 7, Windows 8, Windows 10 and Mac OS X v10.6+ (Software download required for Mac, see official SanDisk Secure Access website for more details.))
- Store more with capacities up to 16GB (1 gigabyte (GB) = 1 billion bytes. Some capacity not available for data storage.)
Where UAC saves collected artifacts
The operator supplies the destination directory when invoking UAC; the README’s examples use /tmp. Output is organized according to the collection and artifact definitions. For example, the file collector copies selected files into the output structure, while command saves stdout to its configured output and logs stderr to uac.log unless redirected. Check destination access and capacity before running a collection.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
