RcloneConf

# PowerShell Artifact Collection Script
# Target: RcloneConf
# Run as Administrator

#Requires -RunAsAdministrator

$ErrorActionPreference = "SilentlyContinue"
$DestBase = "D:\Evidence"

# Function to handle artifact collection with robocopy
function Collect-Artifact {
    param (
        [string]$SourceDir,
        [string]$FolderName,
        [string]$FileMask = "*"
    )
    $FullDest = Join-Path -Path $DestBase -ChildPath $FolderName
    robocopy "$SourceDir" "$FullDest" "$FileMask" /E /COPY:DAT /R:0 /W:0 /NP /NFL /NDL /NJH /NJS | Out-Null
}

# 1. Rclone config - User Folder
$UserPath = Join-Path $env:USERPROFILE ""
Collect-Artifact -SourceDir "$UserPath" -FileMask ".rclone.conf" -FolderName "Rclone_config___User_Folder"

# 2. Rclone config - SYSTEM SysWOW64 User Folder
Collect-Artifact -SourceDir "C:\Windows\SysWOW64\config\systemprofile" -FileMask ".rclone.conf" -FolderName "Rclone_config___SYSTEM_SysWOW64_User_Folder"

# 3. Rclone config - SYSTEM User Folder
Collect-Artifact -SourceDir "C:\Windows\System32\config\systemprofile" -FileMask ".rclone.conf" -FolderName "Rclone_config___SYSTEM_User_Folder"

# 4. Rclone config - LocalService User Folder
Collect-Artifact -SourceDir "C:\Windows\ServiceProfiles\LocalService" -FileMask ".rclone.conf" -FolderName "Rclone_config___LocalService_User_Folder"

# 5. Rclone config - NetworkService User Folder
Collect-Artifact -SourceDir "C:\Windows\ServiceProfiles\NetworkService" -FileMask ".rclone.conf" -FolderName "Rclone_config___NetworkService_User_Folder"

# 6. Rclone config - User .config Folder
$UserPath = Join-Path $env:USERPROFILE ".config\rclone"
Collect-Artifact -SourceDir "$UserPath" -FileMask "rclone.conf" -FolderName "Rclone_config___User__config_Folder"

# 7. Rclone config - SYSTEM SysWOW64 User .config Folder
Collect-Artifact -SourceDir "C:\Windows\SysWOW64\config\systemprofile\.config\rclone" -FileMask "rclone.conf" -FolderName "Rclone_config___SYSTEM_SysWOW64_User__config_Folder"

# 8. Rclone config - SYSTEM User .config Folder
Collect-Artifact -SourceDir "C:\Windows\System32\config\systemprofile\.config\rclone" -FileMask "rclone.conf" -FolderName "Rclone_config___SYSTEM_User__config_Folder"

# 9. Rclone config - LocalService User .config Folder
Collect-Artifact -SourceDir "C:\Windows\ServiceProfiles\LocalService\.config\rclone" -FileMask "rclone.conf" -FolderName "Rclone_config___LocalService_User__config_Folder"

# 10. Rclone config - NetworkService User .config Folder
Collect-Artifact -SourceDir "C:\Windows\ServiceProfiles\NetworkService\.config\rclone" -FileMask "rclone.conf" -FolderName "Rclone_config___NetworkService_User__config_Folder"

# 11. Rclone config - User config Folder - XDG_CONFIG_HOME Default
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\rclone"
Collect-Artifact -SourceDir "$UserPath" -FileMask "rclone.conf" -FolderName "Rclone_config___User_config_Folder___XDG_CONFIG_HOME_Default"

# 12. Rclone config - SYSTEM SysWOW64 User config Folder - XDG_CONFIG_HOME Default
Collect-Artifact -SourceDir "C:\Windows\SysWOW64\config\systemprofile\AppData\Local\rclone" -FileMask "rclone.conf" -FolderName "Rclone_config___SYSTEM_SysWOW64_User_config_Folder___XDG_CONFIG_HOME_Default"

# 13. Rclone config - SYSTEM User config Folder - XDG_CONFIG_HOME Default
Collect-Artifact -SourceDir "C:\Windows\System32\config\systemprofile\AppData\Local\rclone" -FileMask "rclone.conf" -FolderName "Rclone_config___SYSTEM_User_config_Folder___XDG_CONFIG_HOME_Default"

# 14. Rclone config - LocalService User config Folder - XDG_CONFIG_HOME Default
Collect-Artifact -SourceDir "C:\Windows\ServiceProfiles\LocalService\AppData\Local\rclone" -FileMask "rclone.conf" -FolderName "Rclone_config___LocalService_User_config_Folder___XDG_CONFIG_HOME_Default"

# 15. Rclone config - NetworkService User config Folder - XDG_CONFIG_HOME Default
Collect-Artifact -SourceDir "C:\Windows\ServiceProfiles\NetworkService\AppData\Local\rclone" -FileMask "rclone.conf" -FolderName "Rclone_config___NetworkService_User_config_Folder___XDG_CONFIG_HOME_Default"

# 16. Rclone config - User config Folder - Roaming
$UserPath = Join-Path $env:USERPROFILE "AppData\Roaming\rclone"
Collect-Artifact -SourceDir "$UserPath" -FileMask "rclone.conf" -FolderName "Rclone_config___User_config_Folder___Roaming"

# 17. Rclone config - SYSTEM SysWOW64 User config Folder - Roaming
Collect-Artifact -SourceDir "C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\rclone" -FileMask "rclone.conf" -FolderName "Rclone_config___SYSTEM_SysWOW64_User_config_Folder___Roaming"

# 18. Rclone config - SYSTEM User config Folder - Roaming
Collect-Artifact -SourceDir "C:\Windows\System32\config\systemprofile\AppData\Roaming\rclone" -FileMask "rclone.conf" -FolderName "Rclone_config___SYSTEM_User_config_Folder___Roaming"

# 19. Rclone config - LocalService User config Folder - Roaming
Collect-Artifact -SourceDir "C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\rclone" -FileMask "rclone.conf" -FolderName "Rclone_config___LocalService_User_config_Folder___Roaming"

# 20. Rclone config - NetworkService User config Folder - Roaming
Collect-Artifact -SourceDir "C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\rclone" -FileMask "rclone.conf" -FolderName "Rclone_config___NetworkService_User_config_Folder___Roaming"

# 21. Rclone config - SysWOW64 Sideloaded Config
Collect-Artifact -SourceDir "C:\Windows\SysWOW64" -FileMask "rclone.conf" -FolderName "Rclone_config___SysWOW64_Sideloaded_Config"

# 22. Rclone config - System32 Sideloaded Config
Collect-Artifact -SourceDir "C:\Windows\System32" -FileMask "rclone.conf" -FolderName "Rclone_config___System32_Sideloaded_Config"

# 23. Rclone config - Windows Sideloaded Config
Collect-Artifact -SourceDir "C:\Windows" -FileMask "rclone.conf" -FolderName "Rclone_config___Windows_Sideloaded_Config"

# 24. Rclone config - Recursive
Collect-Artifact -SourceDir "C:\" -FileMask "rclone.conf" -FolderName "Rclone_config___Recursive"

# 25. Rclone config fallback - Recursive
Collect-Artifact -SourceDir "C:\" -FileMask ".rclone.conf" -FolderName "Rclone_config_fallback___Recursive"

Write-Host "Collection complete!" -ForegroundColor Green