dfirhub

JavaWebCache

Appsv1

Author: piesecurity

description

Java WebStart Cache - (IDX Files)

paths

11 paths
CommunicationsJava WebStart Cache User Level - Default
C:\Users\%user%\AppData\Local\Sun\Java\Deployment\cache\*\*\*.idx
CommunicationsJava WebStart Cache User Level - IE Protected Mode
C:\Users\%user%\AppData\LocalLow\Sun\Java\Deployment\cache\*\*\*.idx
CommunicationsJava WebStart Cache System level
C:\Windows\System32\config\systemprofile\AppData\Local\Sun\Java\Deployment\cache\*\*\*.idx
CommunicationsJava WebStart Cache System level
C:\Windows.old\Windows\System32\config\systemprofile\AppData\Local\Sun\Java\Deployment\cache\*\*\*.idx
CommunicationsJava WebStart Cache System level - IE Protected Mode
C:\Windows\System32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment\cache\*\*\*.idx
CommunicationsJava WebStart Cache System level - IE Protected Mode
C:\Windows.old\Windows\System32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment\cache\*\*\*.idx
CommunicationsJava WebStart Cache System level (SysWow64)
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Sun\Java\Deployment\cache\*\*\*.idx
CommunicationsJava WebStart Cache System level (SysWow64)
C:\Windows.old\Windows\SysWOW64\config\systemprofile\AppData\Local\Sun\Java\Deployment\cache\*\*\*.idx
CommunicationsJava WebStart Cache System level (SysWow64) - IE Protected Mode
C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment\cache\*\*\*.idx
CommunicationsJava WebStart Cache System level (SysWow64) - IE Protected Mode
C:\Windows.old\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment\cache\*\*\*.idx
CommunicationsJava WebStart Cache User Level - XP
C:\Documents and Settings\%user%\Application Data\Sun\Java\Deployment\cache\*\*\*.idx
› paths use Windows environment syntax

collection commands 

# PowerShell Artifact Collection Script
# Target: JavaWebCache
# Run as Administrator

#Requires -RunAsAdministrator

$ErrorActionPreference = "SilentlyContinue"
$DestBase = "D:\Evidence"

# Function to handle directory creation and copying
function Collect-Artifact {
    param (
        [string]$SourcePath,
        [string]$FolderName
    )
    $FullDest = Join-Path -Path $DestBase -ChildPath $FolderName
    if (-not (Test-Path -Path $FullDest)) {
        New-Item -ItemType Directory -Path $FullDest -Force | Out-Null
    }
    Copy-Item -Path $SourcePath -Destination $FullDest -Recurse -Force
}

# 1. Java WebStart Cache User Level - Default
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Sun\Java\Deployment\cache\*\*\"
Collect-Artifact -SourcePath "$UserPath\*.idx" -FolderName "Java_WebStart_Cache_User_Level___Default"

# 2. Java WebStart Cache User Level - IE Protected Mode
$UserPath = Join-Path $env:USERPROFILE "AppData\LocalLow\Sun\Java\Deployment\cache\*\*\"
Collect-Artifact -SourcePath "$UserPath\*.idx" -FolderName "Java_WebStart_Cache_User_Level___IE_Protected_Mode"

# 3. Java WebStart Cache System level
Collect-Artifact -SourcePath "C:\Windows\System32\config\systemprofile\AppData\Local\Sun\Java\Deployment\cache\*\*\\*.idx" -FolderName "Java_WebStart_Cache_System_level"

# 4. Java WebStart Cache System level
Collect-Artifact -SourcePath "C:\Windows.old\Windows\System32\config\systemprofile\AppData\Local\Sun\Java\Deployment\cache\*\*\\*.idx" -FolderName "Java_WebStart_Cache_System_level"

# 5. Java WebStart Cache System level - IE Protected Mode
Collect-Artifact -SourcePath "C:\Windows\System32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment\cache\*\*\\*.idx" -FolderName "Java_WebStart_Cache_System_level___IE_Protected_Mode"

# 6. Java WebStart Cache System level - IE Protected Mode
Collect-Artifact -SourcePath "C:\Windows.old\Windows\System32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment\cache\*\*\\*.idx" -FolderName "Java_WebStart_Cache_System_level___IE_Protected_Mode"

# 7. Java WebStart Cache System level (SysWow64)
Collect-Artifact -SourcePath "C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Sun\Java\Deployment\cache\*\*\\*.idx" -FolderName "Java_WebStart_Cache_System_level__SysWow64_"

# 8. Java WebStart Cache System level (SysWow64)
Collect-Artifact -SourcePath "C:\Windows.old\Windows\SysWOW64\config\systemprofile\AppData\Local\Sun\Java\Deployment\cache\*\*\\*.idx" -FolderName "Java_WebStart_Cache_System_level__SysWow64_"

# 9. Java WebStart Cache System level (SysWow64) - IE Protected Mode
Collect-Artifact -SourcePath "C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment\cache\*\*\\*.idx" -FolderName "Java_WebStart_Cache_System_level__SysWow64____IE_Protected_Mode"

# 10. Java WebStart Cache System level (SysWow64) - IE Protected Mode
Collect-Artifact -SourcePath "C:\Windows.old\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment\cache\*\*\\*.idx" -FolderName "Java_WebStart_Cache_System_level__SysWow64____IE_Protected_Mode"

# 11. Java WebStart Cache User Level - XP
$UserPath = Join-Path $env:USERPROFILE "Application Data\Sun\Java\Deployment\cache\*\*\"
Collect-Artifact -SourcePath "$UserPath\*.idx" -FolderName "Java_WebStart_Cache_User_Level___XP"

Write-Host "Collection complete!" -ForegroundColor Green

› Save as .ps1 and run as Administrator. Use: powershell -ExecutionPolicy Bypass -File script.ps1