Gobbling Up Forensic Analysis Data Using Velociraptor

This blog describes step-by-step how to ingest a Velociraptor Offline Collector ZIP into a Velociraptor server via the Admin GUI—covering permission checks (ownership/chown), selecting the Server.Utils.ImportCollection artifact, configuring the victim hostname and file path, launching the import, and reviewing results. It highlights common macOS artifacts (e.g., Bash history, user lists, browser histories) useful for initial triage and notes typical pitfalls such as permission-denied errors due to incorrect file ownership.