AnyDesk

# PowerShell Artifact Collection Script
# Target: AnyDesk
# Run as Administrator

#Requires -RunAsAdministrator

$ErrorActionPreference = "SilentlyContinue"
$DestBase = "D:\Evidence"

# Function to handle artifact collection with robocopy
function Collect-Artifact {
    param (
        [string]$SourceDir,
        [string]$FolderName,
        [string]$FileMask = "*"
    )
    $FullDest = Join-Path -Path $DestBase -ChildPath $FolderName
    robocopy "$SourceDir" "$FullDest" "$FileMask" /E /COPY:DAT /R:0 /W:0 /NP /NFL /NDL /NJH /NJS | Out-Null
}

# 1. AnyDesk Logs - User Profile - *.trace
$UserPath = Join-Path $env:USERPROFILE "AppData\Roaming\AnyDesk\"
Collect-Artifact -SourceDir "$UserPath" -FileMask "*.trace" -FolderName "AnyDesk_Logs___User_Profile_____trace"

# 2. AnyDesk Logs - ProgramData - *.trace
Collect-Artifact -SourceDir "C:\ProgramData\AnyDesk\" -FileMask "*.trace" -FolderName "AnyDesk_Logs___ProgramData_____trace"

# 3. AnyDesk Logs - User Profile - *.conf
$UserPath = Join-Path $env:USERPROFILE "AppData\Roaming\AnyDesk\"
Collect-Artifact -SourceDir "$UserPath" -FileMask "*.conf" -FolderName "AnyDesk_Logs___User_Profile_____conf"

# 4. AnyDesk Logs - ProgramData - *.conf
Collect-Artifact -SourceDir "C:\ProgramData\AnyDesk\" -FileMask "*.conf" -FolderName "AnyDesk_Logs___ProgramData_____conf"

# 5. AnyDesk Videos
$UserPath = Join-Path $env:USERPROFILE "Videos\AnyDesk\"
Collect-Artifact -SourceDir "$UserPath" -FileMask "*.anydesk" -FolderName "AnyDesk_Videos"

# 6. AnyDesk Logs - User Profile - connection_trace.txt
$UserPath = Join-Path $env:USERPROFILE "AppData\Roaming\AnyDesk\"
Collect-Artifact -SourceDir "$UserPath" -FileMask "connection_trace.txt" -FolderName "AnyDesk_Logs___User_Profile___connection_trace_txt"

# 7. AnyDesk Logs - ProgramData - connection_trace.txt
Collect-Artifact -SourceDir "C:\ProgramData\AnyDesk\" -FileMask "connection_trace.txt" -FolderName "AnyDesk_Logs___ProgramData___connection_trace_txt"

# 8. AnyDesk Logs - System User Account
Collect-Artifact -SourceDir "C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\AnyDesk\" -FolderName "AnyDesk_Logs___System_User_Account"

# 9. AnyDesk Chat Logs - User Profile
$UserPath = Join-Path $env:USERPROFILE "AppData\Roaming\AnyDesk\chat"
Collect-Artifact -SourceDir "$UserPath" -FileMask "*.txt" -FolderName "AnyDesk_Chat_Logs___User_Profile"

# 10. AnyDesk File Transfer Logs - Running in portable mode
$UserPath = Join-Path $env:USERPROFILE "AppData\Roaming\AnyDesk"
Collect-Artifact -SourceDir "$UserPath" -FileMask "file_transfer_trace.txt" -FolderName "AnyDesk_File_Transfer_Logs___Running_in_portable_mode"

# 11. AnyDesk File Transfer Logs - Installed as a Service
Collect-Artifact -SourceDir "C:\ProgramData\AnyDesk\" -FileMask "file_transfer_trace.txt" -FolderName "AnyDesk_File_Transfer_Logs___Installed_as_a_Service"

Write-Host "Collection complete!" -ForegroundColor Green