IDrive

# PowerShell Artifact Collection Script
# Target: IDrive
# Run as Administrator

#Requires -RunAsAdministrator

$ErrorActionPreference = "SilentlyContinue"
$DestBase = "D:\Evidence"

# Function to handle artifact collection with robocopy
function Collect-Artifact {
    param (
        [string]$SourceDir,
        [string]$FolderName,
        [string]$FileMask = "*"
    )
    $FullDest = Join-Path -Path $DestBase -ChildPath $FolderName
    robocopy "$SourceDir" "$FullDest" "$FileMask" /E /COPY:DAT /R:0 /W:0 /NP /NFL /NDL /NJH /NJS | Out-Null
}

# 1. IDrive Cleanup Operations
Collect-Artifact -SourceDir "C:\ProgramData\IDrive\IBCOMMON\*\Session\Archive Cleanup\" -FileMask "*" -FolderName "IDrive_Cleanup_Operations"

# 2. IDrive Backup Operations
Collect-Artifact -SourceDir "C:\ProgramData\IDrive\IBCOMMON\*\Session\Backup\" -FileMask "*" -FolderName "IDrive_Backup_Operations"

# 3. IDrive Delete Operations
Collect-Artifact -SourceDir "C:\ProgramData\IDrive\IBCOMMON\*\Session\Delete\" -FileMask "*" -FolderName "IDrive_Delete_Operations"

# 4. IDrive Restore Operations
Collect-Artifact -SourceDir "C:\ProgramData\IDrive\IBCOMMON\*\Session\Restore\" -FileMask "*" -FolderName "IDrive_Restore_Operations"

# 5. IDrive Backup Summary
Collect-Artifact -SourceDir "C:\ProgramData\IDrive\IBCOMMON\*\Session\LOGXML\" -FileMask "*xml" -FolderName "IDrive_Backup_Summary"

# 6. IDrive Tracefile
Collect-Artifact -SourceDir "C:\ProgramData\IDrive\IBCOMMON\*\" -FileMask "Tracefile.txt" -FolderName "IDrive_Tracefile"

# 7. IDrive Mapped Drives
Collect-Artifact -SourceDir "C:\ProgramData\IDrive\IBCOMMON\" -FileMask "IDMappedDrives.txt" -FolderName "IDrive_Mapped_Drives"

# 8. IDrive Backup Schedule
Collect-Artifact -SourceDir "C:\ProgramData\IDrive\IBCOMMON\" -FileMask "schedule.xml" -FolderName "IDrive_Backup_Schedule"

# 9. IDrive Schedule History
Collect-Artifact -SourceDir "C:\ProgramData\IDrive\IBCOMMON\" -FileMask "Sch_Trace.txt" -FolderName "IDrive_Schedule_History"

# 10. IDrive Configuration
Collect-Artifact -SourceDir "C:\ProgramData\IDrive\IBCOMMON\" -FileMask "idrive.ini" -FolderName "IDrive_Configuration"

# 11. IDrive Local Drives
Collect-Artifact -SourceDir "C:\ProgramData\IDrive\IBCOMMON\" -FileMask "get_Alldrives.txt" -FolderName "IDrive_Local_Drives"

# 12. IDrive Exclusion Configurations
Collect-Artifact -SourceDir "C:\ProgramData\IDrive\IBCOMMON\" -FileMask "Exclude*" -FolderName "IDrive_Exclusion_Configurations"

# 13. IDrive User Details
Collect-Artifact -SourceDir "C:\ProgramData\IDrive\IBCOMMON\" -FileMask "AutoComp.ini" -FolderName "IDrive_User_Details"

# 14. IDrive SQL Databse
Collect-Artifact -SourceDir "C:\ProgramData\IDrive\IBCOMMON\*\LDBNEW\*\" -FileMask "*.ibds" -FolderName "IDrive_SQL_Databse"

Write-Host "Collection complete!" -ForegroundColor Green