OutlookPSTOST

# PowerShell Artifact Collection Script
# Target: OutlookPSTOST
# Run as Administrator

#Requires -RunAsAdministrator

$ErrorActionPreference = "SilentlyContinue"
$DestBase = "D:\Evidence"

# Function to handle artifact collection with robocopy
function Collect-Artifact {
    param (
        [string]$SourceDir,
        [string]$FolderName,
        [string]$FileMask = "*"
    )
    $FullDest = Join-Path -Path $DestBase -ChildPath $FolderName
    robocopy "$SourceDir" "$FullDest" "$FileMask" /E /COPY:DAT /R:0 /W:0 /NP /NFL /NDL /NJH /NJS | Out-Null
}

# 1. PST XP
$UserPath = Join-Path $env:USERPROFILE "Local Settings\Application Data\Microsoft\Outlook\"
Collect-Artifact -SourceDir "$UserPath" -FileMask "*.pst" -FolderName "PST_XP"

# 2. OST XP
$UserPath = Join-Path $env:USERPROFILE "Local Settings\Application Data\Microsoft\Outlook\"
Collect-Artifact -SourceDir "$UserPath" -FileMask "*.ost" -FolderName "OST_XP"

# 3. PST (2013 or 2016)
$UserPath = Join-Path $env:USERPROFILE "Documents\Outlook Files\"
Collect-Artifact -SourceDir "$UserPath" -FileMask "*.pst" -FolderName "PST__2013_or_2016_"

# 4. OST (2013 or 2016)
$UserPath = Join-Path $env:USERPROFILE "Documents\Outlook Files\"
Collect-Artifact -SourceDir "$UserPath" -FileMask "*.ost" -FolderName "OST__2013_or_2016_"

# 5. PST
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Microsoft\Outlook\"
Collect-Artifact -SourceDir "$UserPath" -FileMask "*.pst" -FolderName "PST"

# 6. OST
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Microsoft\Outlook\"
Collect-Artifact -SourceDir "$UserPath" -FileMask "*.ost" -FolderName "OST"

# 7. NST
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Microsoft\Outlook\"
Collect-Artifact -SourceDir "$UserPath" -FileMask "*.nst" -FolderName "NST"

# 8. Outlook Attachment Temporary Storage
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\"
Collect-Artifact -SourceDir "$UserPath" -FolderName "Outlook_Attachment_Temporary_Storage"

Write-Host "Collection complete!" -ForegroundColor Green