CyLR (Live Response Collection Tool) gathers essential forensic files (MFT, registry hives, event logs, prefetch, etc.) from a running Windows system and packages them into a single compressed archive, ideal for incident response that requires rapid acquisition before the machine is shut down.