dfirhub

MouseWithoutBorders

Appsv1

Author: Mohamed Sultan

description

Mouse Without Borders

paths

4 paths
CommunicationsMouse Without Borders settings - settings.json
C:\Users\%user%\AppData\Local\Microsoft\PowerToys\MouseWithoutBorderssettings.json

Collects the settings file which contains configurations for Mouse Without Borders

CommunicationsMouse Without Borders Logs folder
C:\Users\%user%\AppData\Local\Microsoft\PowerToys\MouseWithoutBorders\Logs\*

Collects the Logs folder for Mouse Without Borders

CommunicationsMouse Without Borders runtime activity logs
C:\Users\%user%\AppData\Local\Microsoft\PowerToys\MouseWithoutBorders\LogsModuleInterface*

Collects runtime activity logs

CommunicationsMouse Without Borders msi log - MagicMouse.log
C:\Program Files (x86)\Microsoft Garage\Mouse without BordersMagicMouse.log

Collects the log file of the Mouse Without Borders MSI version

› paths use Windows environment syntax

collection commands 

# PowerShell Artifact Collection Script
# Target: MouseWithoutBorders
# Run as Administrator

#Requires -RunAsAdministrator

$ErrorActionPreference = "SilentlyContinue"
$DestBase = "D:\Evidence"

# Function to handle directory creation and copying
function Collect-Artifact {
    param (
        [string]$SourcePath,
        [string]$FolderName
    )
    $FullDest = Join-Path -Path $DestBase -ChildPath $FolderName
    if (-not (Test-Path -Path $FullDest)) {
        New-Item -ItemType Directory -Path $FullDest -Force | Out-Null
    }
    Copy-Item -Path $SourcePath -Destination $FullDest -Recurse -Force
}

# 1. Mouse Without Borders settings - settings.json
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Microsoft\PowerToys\MouseWithoutBorders"
Collect-Artifact -SourcePath "$UserPath\settings.json" -FolderName "Mouse_Without_Borders_settings___settings_json"

# 2. Mouse Without Borders Logs folder
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Microsoft\PowerToys\MouseWithoutBorders\Logs\"
Collect-Artifact -SourcePath "$UserPath\*" -FolderName "Mouse_Without_Borders_Logs_folder"

# 3. Mouse Without Borders runtime activity logs
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Microsoft\PowerToys\MouseWithoutBorders\LogsModuleInterface"
Collect-Artifact -SourcePath "$UserPath\*" -FolderName "Mouse_Without_Borders_runtime_activity_logs"

# 4. Mouse Without Borders msi log - MagicMouse.log
Collect-Artifact -SourcePath "C:\Program Files (x86)\Microsoft Garage\Mouse without Borders\MagicMouse.log" -FolderName "Mouse_Without_Borders_msi_log___MagicMouse_log"

Write-Host "Collection complete!" -ForegroundColor Green

› Save as .ps1 and run as Administrator. Use: powershell -ExecutionPolicy Bypass -File script.ps1

references