dfirhub

BrowserCache

Browsersv1.1

Author: Bjorn Vanhaeren

description

Browser Caches

paths

8 paths
CommunicationsChrome Cache Folder
C:\Users\%user%\AppData\Local\Google\Chrome\User Data\*\Cache\
CommunicationsChromium Edge Cache Folder
C:\Users\%user%\AppData\Local\Microsoft\Edge\User Data\*\Cache\
CommunicationsFirefox Cache Folder
C:\Users\%user%\AppData\Local\Mozilla\Firefox\Profiles\*\
CommunicationsIE 9/10 Cache
C:\Users\%user%\AppData\Local\Microsoft\Windows\Temporary Internet Files\
CommunicationsIE Index.dat temp internet files
C:\Documents and Settings\%user%\Local Settings\Temporary Internet Files\Content.IE5\index.dat
CommunicationsIE 11 Cache
C:\Users\%user%\AppData\Local\Microsoft\Windows\INetCache\
CommunicationsEdge WebcacheV01.dat
C:\Users\%user%\AppData\Local\Microsoft\Windows\WebCache\
CommunicationsBrave Cache Folder
C:\Users\%users%\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Cache\Cache_Data
› paths use Windows environment syntax

collection commands 

# PowerShell Artifact Collection Script
# Target: BrowserCache
# Run as Administrator

#Requires -RunAsAdministrator

$ErrorActionPreference = "SilentlyContinue"
$DestBase = "D:\Evidence"

# Function to handle directory creation and copying
function Collect-Artifact {
    param (
        [string]$SourcePath,
        [string]$FolderName
    )
    $FullDest = Join-Path -Path $DestBase -ChildPath $FolderName
    if (-not (Test-Path -Path $FullDest)) {
        New-Item -ItemType Directory -Path $FullDest -Force | Out-Null
    }
    Copy-Item -Path $SourcePath -Destination $FullDest -Recurse -Force
}

# 1. Chrome Cache Folder
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\Cache\"
Collect-Artifact -SourcePath "$UserPath\*" -FolderName "Chrome_Cache_Folder"

# 2. Chromium Edge Cache Folder
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Microsoft\Edge\User Data\*\Cache\"
Collect-Artifact -SourcePath "$UserPath\*" -FolderName "Chromium_Edge_Cache_Folder"

# 3. Firefox Cache Folder
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Mozilla\Firefox\Profiles\*\"
Collect-Artifact -SourcePath "$UserPath\*" -FolderName "Firefox_Cache_Folder"

# 4. IE 9/10 Cache
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Microsoft\Windows\Temporary Internet Files\"
Collect-Artifact -SourcePath "$UserPath\*" -FolderName "IE_9_10_Cache"

# 5. IE Index.dat temp internet files
$UserPath = Join-Path $env:USERPROFILE "Local Settings\Temporary Internet Files\Content.IE5\"
Collect-Artifact -SourcePath "$UserPath\index.dat" -FolderName "IE_Index_dat_temp_internet_files"

# 6. IE 11 Cache
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Microsoft\Windows\INetCache\"
Collect-Artifact -SourcePath "$UserPath\*" -FolderName "IE_11_Cache"

# 7. Edge WebcacheV01.dat
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Microsoft\Windows\WebCache\"
Collect-Artifact -SourcePath "$UserPath\*" -FolderName "Edge_WebcacheV01_dat"

# 8. Brave Cache Folder
Collect-Artifact -SourcePath "C:\Users\%users%\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Cache\Cache_Data\*" -FolderName "Brave_Cache_Folder"

Write-Host "Collection complete!" -ForegroundColor Green

› Save as .ps1 and run as Administrator. Use: powershell -ExecutionPolicy Bypass -File script.ps1