dfirhub

EventTraceLogs

Windowsv1.1

Author: Mark Hallman

description

Event Trace Logs

paths

10 paths
EventTraceLogsWDI Trace Logs 1
C:\Windows\System32\WDI\LogFiles\*.etl*
EventTraceLogsWDI Trace Logs 1
C:\Windows.old\Windows\System32\WDI\LogFiles\*.etl*
EventTraceLogsWDI Trace Logs 2
C:\Windows\System32\WDI\{*\
EventTraceLogsWDI Trace Logs 2
C:\Windows.old\Windows\System32\WDI\{*\
EventTraceLogsWMI Trace Logs
C:\Windows\System32\LogFiles\WMI\
EventTraceLogsWMI Trace Logs
C:\Windows.old\Windows\System32\LogFiles\WMI\
EventTraceLogsSleepStudy Trace Logs
C:\Windows\System32\SleepStudy\
EventTraceLogsSleepStudy Trace Logs
C:\Windows.old\Windows\System32\SleepStudy\
EventTraceLogsEnergy-NTKL Trace Logs
C:\ProgramData\Microsoft\Windows\PowerEfficiency Diagnostics\energy-ntkl.etl
EventTraceLogsDelivery Optimization Trace Logs
C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\Logs\*.etl*
› paths use Windows environment syntax

collection commands 

# PowerShell Artifact Collection Script
# Target: EventTraceLogs
# Run as Administrator

#Requires -RunAsAdministrator

$ErrorActionPreference = "SilentlyContinue"
$DestBase = "D:\Evidence"

# Function to handle directory creation and copying
function Collect-Artifact {
    param (
        [string]$SourcePath,
        [string]$FolderName
    )
    $FullDest = Join-Path -Path $DestBase -ChildPath $FolderName
    if (-not (Test-Path -Path $FullDest)) {
        New-Item -ItemType Directory -Path $FullDest -Force | Out-Null
    }
    Copy-Item -Path $SourcePath -Destination $FullDest -Recurse -Force
}

# 1. WDI Trace Logs 1
Collect-Artifact -SourcePath "C:\Windows\System32\WDI\LogFiles\\*.etl*" -FolderName "WDI_Trace_Logs_1"

# 2. WDI Trace Logs 1
Collect-Artifact -SourcePath "C:\Windows.old\Windows\System32\WDI\LogFiles\\*.etl*" -FolderName "WDI_Trace_Logs_1"

# 3. WDI Trace Logs 2
Collect-Artifact -SourcePath "C:\Windows\System32\WDI\{*\\*" -FolderName "WDI_Trace_Logs_2"

# 4. WDI Trace Logs 2
Collect-Artifact -SourcePath "C:\Windows.old\Windows\System32\WDI\{*\\*" -FolderName "WDI_Trace_Logs_2"

# 5. WMI Trace Logs
Collect-Artifact -SourcePath "C:\Windows\System32\LogFiles\WMI\\*" -FolderName "WMI_Trace_Logs"

# 6. WMI Trace Logs
Collect-Artifact -SourcePath "C:\Windows.old\Windows\System32\LogFiles\WMI\\*" -FolderName "WMI_Trace_Logs"

# 7. SleepStudy Trace Logs
Collect-Artifact -SourcePath "C:\Windows\System32\SleepStudy\\*" -FolderName "SleepStudy_Trace_Logs"

# 8. SleepStudy Trace Logs
Collect-Artifact -SourcePath "C:\Windows.old\Windows\System32\SleepStudy\\*" -FolderName "SleepStudy_Trace_Logs"

# 9. Energy-NTKL Trace Logs
Collect-Artifact -SourcePath "C:\ProgramData\Microsoft\Windows\PowerEfficiency Diagnostics\\energy-ntkl.etl" -FolderName "Energy_NTKL_Trace_Logs"

# 10. Delivery Optimization Trace Logs
Collect-Artifact -SourcePath "C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\Logs\\*.etl*" -FolderName "Delivery_Optimization_Trace_Logs"

Write-Host "Collection complete!" -ForegroundColor Green

› Save as .ps1 and run as Administrator. Use: powershell -ExecutionPolicy Bypass -File script.ps1

references

included in collections

SANS_Triage CombinedLogs