LNKFilesAndJumpLists

# PowerShell Artifact Collection Script
# Target: LNKFilesAndJumpLists
# Run as Administrator

#Requires -RunAsAdministrator

$ErrorActionPreference = "SilentlyContinue"
$DestBase = "D:\Evidence"

# Function to handle artifact collection with robocopy
function Collect-Artifact {
    param (
        [string]$SourceDir,
        [string]$FolderName,
        [string]$FileMask = "*"
    )
    $FullDest = Join-Path -Path $DestBase -ChildPath $FolderName
    robocopy "$SourceDir" "$FullDest" "$FileMask" /E /COPY:DAT /R:0 /W:0 /NP /NFL /NDL /NJH /NJS | Out-Null
}

# 1. LNK Files from Recent
$UserPath = Join-Path $env:USERPROFILE "AppData\Roaming\Microsoft\Windows\Recent\"
Collect-Artifact -SourceDir "$UserPath" -FolderName "LNK_Files_from_Recent"

# 2. LNK Files from Microsoft Office Recent
$UserPath = Join-Path $env:USERPROFILE "AppData\Roaming\Microsoft\Office\Recent\"
Collect-Artifact -SourceDir "$UserPath" -FolderName "LNK_Files_from_Microsoft_Office_Recent"

# 3. Start Menu LNK Files
$UserPath = Join-Path $env:USERPROFILE "AppData\Roaming\Microsoft\Windows\Start Menu\Programs"
Collect-Artifact -SourceDir "$UserPath" -FileMask "*.LNK" -FolderName "Start_Menu_LNK_Files"

# 4. LNK Files from Recent (XP)
$UserPath = Join-Path $env:USERPROFILE "Recent\"
Collect-Artifact -SourceDir "$UserPath" -FolderName "LNK_Files_from_Recent__XP_"

# 5. Desktop LNK Files XP
$UserPath = Join-Path $env:USERPROFILE "Desktop\"
Collect-Artifact -SourceDir "$UserPath" -FileMask "*.LNK" -FolderName "Desktop_LNK_Files_XP"

# 6. Desktop LNK Files
$UserPath = Join-Path $env:USERPROFILE "Desktop\"
Collect-Artifact -SourceDir "$UserPath" -FileMask "*.LNK" -FolderName "Desktop_LNK_Files"

# 7. Restore point LNK Files XP
Collect-Artifact -SourceDir "C:\System Volume Information\_restore*\RP*\" -FileMask "*.LNK" -FolderName "Restore_point_LNK_Files_XP"

# 8. LNK Files from C:\ProgramData
Collect-Artifact -SourceDir "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\" -FileMask "*.LNK" -FolderName "LNK_Files_from_C__ProgramData"

Write-Host "Collection complete!" -ForegroundColor Green