FileGuardian
Malware artifact capture for Windows. FileGuardian watches a selected directory tree and attempts to preserve newly created or modified files before they are deleted.
The GUI, CLI, and built-in plugins ship in one self-contained Windows x64 executable. Collection is session-based, with versioned evidence, a central index, SHA-256 hashing, and plugin support.
FileGuardian is an artifact acquisition tool, not a backup utility, malware detector, sandbox, or sample launcher. It never executes captured files. It runs in user mode rather than as a kernel minifilter, so collection is best-effort, not guaranteed.
Source is not public; binaries are distributed through GitHub Releases. Earlier open-source versions: file-guardian-monitor and File Guardian v4 (cross-platform).
