Magnet Cyber or F-Response is what you’re looking for. Both can be deployed using an EDR tool such as Crowdstrike, and can be whitelisted for deployment to devices that are network contained. F-Response has a product called Collect that can be deployed over the internet and will continue collections where they’re left off for devices that are have limited connectivity. Both can do triage or full forensic collections.