dfirhub

Gigatribe

P2Pv2

Author: Linus Nissi

description

Gigatribe Files

paths

3 paths
FileDownloadGigatribe Files Windows Vista/7/8/10
C:\Users\%user%\AppData\Local\Shalsoft\

Locates Gigatribe files and copies them

FileDownloadGigatribe Files Windows XP
C:\Documents and Settings\%user%\*\Application Data\Gigatribe\

Locates Gigatribe files and copies them. Different path depending on the Operating System language. In Swedish the location is C:\Documents and Settings\<username>\Lokala Inställningar\Application Data\Gigatribe

FileDownloadGigatribe Files Windows XP
C:\Documents and Settings\%user%\*\Application Data\Shalsoft\

Locates Gigatribe files and copies them. Different path depending on the Operating System language. In Swedish the location is C:\Documents and Settings\<username>\Lokala Inställningar\Application Data\Shalsoft

› paths use Windows environment syntax

collection commands 

# PowerShell Artifact Collection Script
# Target: Gigatribe
# Run as Administrator

#Requires -RunAsAdministrator

$ErrorActionPreference = "SilentlyContinue"
$DestBase = "D:\Evidence"

# Function to handle directory creation and copying
function Collect-Artifact {
    param (
        [string]$SourcePath,
        [string]$FolderName
    )
    $FullDest = Join-Path -Path $DestBase -ChildPath $FolderName
    if (-not (Test-Path -Path $FullDest)) {
        New-Item -ItemType Directory -Path $FullDest -Force | Out-Null
    }
    Copy-Item -Path $SourcePath -Destination $FullDest -Recurse -Force
}

# 1. Gigatribe Files Windows Vista/7/8/10
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Shalsoft\"
Collect-Artifact -SourcePath "$UserPath\*" -FolderName "Gigatribe_Files_Windows_Vista_7_8_10"

# 2. Gigatribe Files Windows XP
$UserPath = Join-Path $env:USERPROFILE "*\Application Data\Gigatribe\"
Collect-Artifact -SourcePath "$UserPath\*" -FolderName "Gigatribe_Files_Windows_XP"

# 3. Gigatribe Files Windows XP
$UserPath = Join-Path $env:USERPROFILE "*\Application Data\Shalsoft\"
Collect-Artifact -SourcePath "$UserPath\*" -FolderName "Gigatribe_Files_Windows_XP"

Write-Host "Collection complete!" -ForegroundColor Green

› Save as .ps1 and run as Administrator. Use: powershell -ExecutionPolicy Bypass -File script.ps1

included in collections

P2PClients