Observe network activity
Record endpoint, direction, timing, protocol, observed byte and event metadata from an operator-started Windows capture session.
Nioret Systems - Windows evidence
Nioret Network Forensic Recorder
A Windows network activity recorder that preserves observed connection metadata as local, reviewable evidence for investigations and incident follow-up.
$19.99 at launch14-day free trial; $29.99 one time after the first 30 days
AvailableAvailableOne-time purchase, no subscription. All 1.x updates are included; future major versions are not promised.
PlatformWindows 10/11 x64
Version1.0.0
Trial14 days
Purchase$19.99 launch / $29.99 regular
Verified capabilities
Record metadata. Preserve context. Review evidence.
The recorder captures Windows TCP/IP activity metadata and attempts local application and process attribution. It does not capture packet payloads or inspect HTTPS/TLS plaintext.
Investigate locally
Review applications, processes, connections, health information, case notes, and tags while evidence remains on the PC.
Export reproducibly
Create deterministic ZIP evidence exports with a manifest and hashes for review and preservation workflows.
Use cases and limits
A network forensic recorder for metadata-focused review.
Use it to document a bounded troubleshooting session, review application-to-endpoint activity, or preserve connection metadata for later investigation.
Designed for
- Authorized incident follow-up and workstation troubleshooting
- Reviewing application and process attribution alongside network endpoints
- Case-oriented local evidence notes, tags, health, and exports
- Operator-controlled capture with explicit start, stop, drain, and finalization
Accurate boundaries
- No packet payload capture and no HTTPS/TLS plaintext inspection
- No firewall, IDS/IPS, or network-policy controls
- No automatic cloud upload or automatic evidence deletion
- No guarantee of lossless recording; capture health and loss counters remain visible
Windows requirements and pricing
Know the operating and purchase model.
Capture begins only after an operator action and Windows administrator consent. Evidence defaults to the current Windows account's local app-data folder, and the evidence root can be changed for future sessions.
System requirements
- Windows 10 or Windows 11, x64
- Administrator consent when starting a live capture
- Local storage selected for the evidence budget
- Internet access for trial, purchase, recovery, and activation
$19.99One time during the first 30 days after public launch
$29.99 one time afterward
$29.99 one time afterward
14-day free trial
No subscription. All 1.x updates are included. This offer does not promise future major versions. Protected downloads require an active trial or purchased license.
Trial & Purchase TermsNioret Network Forensic Recorder
Start the 14-day trial.
Use the Download Center to begin the trial or restore existing access to the protected signed installer.