DFIRHub

IRCClients

Compoundv1

Author: Andrew Rathbun

IRC Clients

Includes(3)

Paths

4 pathsfrom 3 targets
Paths use Windows environment variable syntax
CyberChef recipes

Open in CyberChef to decode values extracted from this artifact.

Notes

For those looking to contribute to this list, check here for ideas: https://en.wikipedia.org/wiki/Comparison_of_Internet_Relay_Chat_clients.

Install one of the applications not covered above and find where useful information is stored. If useful information can be located, make an individual Target for it and place in the appropriate folder. Then, include that Target in the appropriate Compound Target.

Collection commands

# PowerShell Artifact Collection Script
# Target: IRCClients
# Run as Administrator

#Requires -RunAsAdministrator

$ErrorActionPreference = "Continue"
$SourceRoot = "C:"
$DestBase   = "D:\Evidence"
$Summary = @{ Copied = 0; Missed = 0; Errors = 0 }

function Collect-Artifact {
    param(
        [Parameter(Mandatory)][string]$SourceDir,
        [Parameter(Mandatory)][string]$FolderName,
        [string]$FileMask = "*"
    )
    # Expand wildcards in any path segment (e.g. 'Program Files*',
    # 'ScreenConnect Client*'). robocopy itself does not glob the source.
    $sources = @(Get-Item -Path $SourceDir -ErrorAction SilentlyContinue |
        Where-Object { $_.PSIsContainer })
    if ($sources.Count -eq 0) {
        $Summary.Missed++
        return
    }
    $FullDest = Join-Path -Path $DestBase -ChildPath $FolderName
    $null = New-Item -ItemType Directory -Force -Path $FullDest -ErrorAction SilentlyContinue
    foreach ($src in $sources) {
        robocopy $src.FullName "$FullDest" "$FileMask" /E /COPY:DAT /R:0 /W:0 /NP /NFL /NDL /NJH /NJS 2>$null | Out-Null
        if ($LASTEXITCODE -le 7) { $Summary.Copied++ } else { $Summary.Errors++ }
    }
}

# Iterate every user profile under the source drive
Get-ChildItem "$SourceRoot\Users" -Directory -ErrorAction SilentlyContinue |
    Where-Object { $_.Name -notin @('All Users', 'Default', 'Default User', 'Public') } |
    ForEach-Object {
        $UserName = $_.Name
        # HexChat Chat Logs
        $UserPath = "$($_.FullName)\AppData\Roaming\HexChat\logs"
        Collect-Artifact -SourceDir $UserPath -FolderName "HexChat_Chat_Logs_$UserName"
        # IceChat Chat Logs
        $UserPath = "$($_.FullName)\AppData\Local\IceChat Networks\IceChat\Logs"
        Collect-Artifact -SourceDir $UserPath -FolderName "IceChat_Chat_Logs_$UserName"
        # mIRC Chat Logs (Vista+)
        $UserPath = "$($_.FullName)\AppData\Roaming\mIRC\logs"
        Collect-Artifact -SourceDir $UserPath -FolderName "mIRC_Chat_Logs_Vista_$UserName"
        # mIRC Chat Logs (2000/XP)
        $UserPath = "$($_.FullName)\Application Data\mIRC\logs"
        Collect-Artifact -SourceDir $UserPath -FolderName "mIRC_Chat_Logs_2000_XP_$UserName"
    }

Write-Host ("Collection complete. Copied: {0}  Missed: {1}  Errors: {2}" -f $Summary.Copied, $Summary.Missed, $Summary.Errors) -ForegroundColor Green

Save as .ps1 and run as Administrator. Use: powershell -ExecutionPolicy Bypass -File script.ps1

Note: This is a compound target that references 3 other targets. The KAPE command resolves them natively; the PowerShell/Batch/WSL scripts flatten every referenced path into explicit copy commands.