DFIRHub

FreeFileSync

Appsv1

Author: Andrew Rathbun

FreeFileSync

Paths

1 path
Paths use Windows environment variable syntax

Notes

FreeFileSync is an awesome program for making copies of the logical contents of a drive, volume, folder, etc.

By default, the logs for each use of this program is stored in an HTML file at the above location.

HTML logs are plain text readable and easy to interpret.

You will find that each file copied is timestamped. Please note this time is recorded as the system time at the time of file copy.

Full file paths are provided in these logs so if files were deleted at the time of seizure of these logs, this will help prove the files existed at a certain date/time.

Collection commands

# PowerShell Artifact Collection Script
# Target: FreeFileSync
# Run as Administrator

#Requires -RunAsAdministrator

$ErrorActionPreference = "Continue"
$SourceRoot = "C:"
$DestBase   = "D:\Evidence"
$Summary = @{ Copied = 0; Missed = 0; Errors = 0 }

function Collect-Artifact {
    param(
        [Parameter(Mandatory)][string]$SourceDir,
        [Parameter(Mandatory)][string]$FolderName,
        [string]$FileMask = "*"
    )
    # Expand wildcards in any path segment (e.g. 'Program Files*',
    # 'ScreenConnect Client*'). robocopy itself does not glob the source.
    $sources = @(Get-Item -Path $SourceDir -ErrorAction SilentlyContinue |
        Where-Object { $_.PSIsContainer })
    if ($sources.Count -eq 0) {
        $Summary.Missed++
        return
    }
    $FullDest = Join-Path -Path $DestBase -ChildPath $FolderName
    $null = New-Item -ItemType Directory -Force -Path $FullDest -ErrorAction SilentlyContinue
    foreach ($src in $sources) {
        robocopy $src.FullName "$FullDest" "$FileMask" /E /COPY:DAT /R:0 /W:0 /NP /NFL /NDL /NJH /NJS 2>$null | Out-Null
        if ($LASTEXITCODE -le 7) { $Summary.Copied++ } else { $Summary.Errors++ }
    }
}

# Iterate every user profile under the source drive
Get-ChildItem "$SourceRoot\Users" -Directory -ErrorAction SilentlyContinue |
    Where-Object { $_.Name -notin @('All Users', 'Default', 'Default User', 'Public') } |
    ForEach-Object {
        $UserName = $_.Name
        # FreeFileSync
        $UserPath = "$($_.FullName)\AppData\Roaming\FreeFileSync\Logs"
        Collect-Artifact -SourceDir $UserPath -FolderName "FreeFileSync_$UserName"
    }

Write-Host ("Collection complete. Copied: {0}  Missed: {1}  Errors: {2}" -f $Summary.Copied, $Summary.Missed, $Summary.Errors) -ForegroundColor Green

Save as .ps1 and run as Administrator. Use: powershell -ExecutionPolicy Bypass -File script.ps1

Included in collections: SANS_TriageCloudStorage_AllCloudStorage_MetadataKapeTriage