Avast

# PowerShell Artifact Collection Script
# Target: Avast
# Run as Administrator

#Requires -RunAsAdministrator

$ErrorActionPreference = "SilentlyContinue"
$DestBase = "D:\Evidence"

# Function to handle artifact collection with robocopy
function Collect-Artifact {
    param (
        [string]$SourceDir,
        [string]$FolderName,
        [string]$FileMask = "*"
    )
    $FullDest = Join-Path -Path $DestBase -ChildPath $FolderName
    robocopy "$SourceDir" "$FullDest" "$FileMask" /E /COPY:DAT /R:0 /W:0 /NP /NFL /NDL /NJH /NJS | Out-Null
}

# 1. Avast AV Logs (XP)
if (Test-Path "C:\Documents And Settings") {
    Collect-Artifact -SourceDir "C:\Documents And Settings\All Users\Application Data\Avast Software\Avast\Log\" -FolderName "Avast_AV_Logs__XP_"
}

# 2. Avast AV Logs
Collect-Artifact -SourceDir "C:\ProgramData\Avast Software\Avast\Log\" -FolderName "Avast_AV_Logs"

# 3. Avast AV User Logs
$UserPath = Join-Path $env:USERPROFILE "Avast Software\Avast\Log\"
Collect-Artifact -SourceDir "$UserPath" -FolderName "Avast_AV_User_Logs"

# 4. Avast AV Index
Collect-Artifact -SourceDir "C:\ProgramData\Avast Software\Avast\Chest\" -FileMask "index.xml" -FolderName "Avast_AV_Index"

# 5. Avast Persistent Data Logs
Collect-Artifact -SourceDir "C:\ProgramData\Avast Software\Persistent Data\Avast\Logs" -FolderName "Avast_Persistent_Data_Logs"

# 6. Avast Icarus Logs
Collect-Artifact -SourceDir "C:\ProgramData\Avast Software\Icarus\Logs" -FolderName "Avast_Icarus_Logs"

Write-Host "Collection complete!" -ForegroundColor Green