Avast

# PowerShell Artifact Collection Script
# Target: Avast
# Run as Administrator

#Requires -RunAsAdministrator

$ErrorActionPreference = "SilentlyContinue"
$DestBase = "D:\Evidence"

# Function to handle directory creation and copying
function Collect-Artifact {
    param (
        [string]$SourcePath,
        [string]$FolderName
    )
    $FullDest = Join-Path -Path $DestBase -ChildPath $FolderName
    if (-not (Test-Path -Path $FullDest)) {
        New-Item -ItemType Directory -Path $FullDest -Force | Out-Null
    }
    Copy-Item -Path $SourcePath -Destination $FullDest -Recurse -Force
}

# 1. Avast AV Logs (XP)
if (Test-Path "C:\Documents And Settings") {
    Collect-Artifact -SourcePath "C:\Documents And Settings\All Users\Application Data\Avast Software\Avast\Log\\*" -FolderName "Avast_AV_Logs__XP_"
}

# 2. Avast AV Logs
Collect-Artifact -SourcePath "C:\ProgramData\Avast Software\Avast\Log\\*" -FolderName "Avast_AV_Logs"

# 3. Avast AV User Logs
$UserPath = Join-Path $env:USERPROFILE "Avast Software\Avast\Log\"
Collect-Artifact -SourcePath "$UserPath\*" -FolderName "Avast_AV_User_Logs"

# 4. Avast AV Index
Collect-Artifact -SourcePath "C:\ProgramData\Avast Software\Avast\Chest\\index.xml" -FolderName "Avast_AV_Index"

# 5. Avast Persistent Data Logs
Collect-Artifact -SourcePath "C:\ProgramData\Avast Software\Persistent Data\Avast\Logs\*" -FolderName "Avast_Persistent_Data_Logs"

# 6. Avast Icarus Logs
Collect-Artifact -SourcePath "C:\ProgramData\Avast Software\Icarus\Logs\*" -FolderName "Avast_Icarus_Logs"

Write-Host "Collection complete!" -ForegroundColor Green