RoamingProfile

Windowsv1.1
Author: Scott Downie
description

User Related Registry Hives, LNK files, etc
paths

73 paths
› paths use Windows environment syntax
collection commands

source:
destination:
# PowerShell Artifact Collection Script
# Target: RoamingProfile
# Run as Administrator

#Requires -RunAsAdministrator

$ErrorActionPreference = "SilentlyContinue"
$DestBase = "D:\Evidence"

# Function to handle artifact collection with robocopy
function Collect-Artifact {
    param (
        [string]$SourceDir,
        [string]$FolderName,
        [string]$FileMask = "*"
    )
    $FullDest = Join-Path -Path $DestBase -ChildPath $FolderName
    robocopy "$SourceDir" "$FullDest" "$FileMask" /E /COPY:DAT /R:0 /W:0 /NP /NFL /NDL /NJH /NJS | Out-Null
}

# 1. NTUSER.DAT registry hive
Collect-Artifact -SourceDir "C:\" -FileMask "NTUSER.DAT" -FolderName "NTUSER_DAT_registry_hive"

# 2. NTUSER.DAT registry transaction files
Collect-Artifact -SourceDir "C:\" -FileMask "NTUSER.DAT.LOG*" -FolderName "NTUSER_DAT_registry_transaction_files"

# 3. NTUSER.DAT DEFAULT registry hive
Collect-Artifact -SourceDir "C:\" -FileMask "DEFAULT" -FolderName "NTUSER_DAT_DEFAULT_registry_hive"

# 4. NTUSER.DAT DEFAULT transaction files
Collect-Artifact -SourceDir "C:\" -FileMask "DEFAULT.LOG*" -FolderName "NTUSER_DAT_DEFAULT_transaction_files"

# 5. UsrClass.dat registry hive
Collect-Artifact -SourceDir "C:\" -FileMask "UsrClass.dat" -FolderName "UsrClass_dat_registry_hive"

# 6. UsrClass.dat registry transaction files
Collect-Artifact -SourceDir "C:\" -FileMask "UsrClass.dat.LOG*" -FolderName "UsrClass_dat_registry_transaction_files"

# 7. LNK Files
Collect-Artifact -SourceDir "C:\" -FileMask "*.LNK" -FolderName "LNK_Files"

# 8. Word Autosave Location
$UserPath = Join-Path $env:USERPROFILE "AppData\Roaming\Microsoft\Word\"
Collect-Artifact -SourceDir "$UserPath" -FolderName "Word_Autosave_Location"

# 9. Excel Autosave Location
$UserPath = Join-Path $env:USERPROFILE "AppData\Roaming\Microsoft\Excel\"
Collect-Artifact -SourceDir "$UserPath" -FolderName "Excel_Autosave_Location"

# 10. PowerPoint Autosave Location
$UserPath = Join-Path $env:USERPROFILE "AppData\Roaming\Microsoft\PowerPoint\"
Collect-Artifact -SourceDir "$UserPath" -FolderName "PowerPoint_Autosave_Location"

# 11. Publisher Autosave Location
$UserPath = Join-Path $env:USERPROFILE "AppData\Roaming\Microsoft\Publisher\"
Collect-Artifact -SourceDir "$UserPath" -FolderName "Publisher_Autosave_Location"

# 12. Publisher Autosave Location
$UserPath = Join-Path $env:USERPROFILE "AppData\Roaming\Microsoft\Word\"
Collect-Artifact -SourceDir "$UserPath" -FolderName "Publisher_Autosave_Location"

# 13. Office Document Cache
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Microsoft\Office\*\OfficeFileCache\"
Collect-Artifact -SourceDir "$UserPath" -FolderName "Office_Document_Cache"

# 14. Office Document Cache
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Microsoft\Office\*\OfficeFileCache\"
Collect-Artifact -SourceDir "$UserPath" -FolderName "Office_Document_Cache"

# 15. Chrome bookmarks
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\"
Collect-Artifact -SourceDir "$UserPath" -FileMask "Bookmarks*" -FolderName "Chrome_bookmarks"

# 16. Chrome bookmarks
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\"
Collect-Artifact -SourceDir "$UserPath" -FileMask "Bookmarks*" -FolderName "Chrome_bookmarks"

# 17. Chrome Cookies
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\"
Collect-Artifact -SourceDir "$UserPath" -FileMask "Cookies*" -FolderName "Chrome_Cookies"

# 18. Chrome Cookies
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\"
Collect-Artifact -SourceDir "$UserPath" -FileMask "Cookies*" -FolderName "Chrome_Cookies"

# 19. Chrome Current Session
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\"
Collect-Artifact -SourceDir "$UserPath" -FileMask "Current Session" -FolderName "Chrome_Current_Session"

# 20. Chrome Current Session
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\"
Collect-Artifact -SourceDir "$UserPath" -FileMask "Current Session" -FolderName "Chrome_Current_Session"

# 21. Chrome Current Tabs
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\"
Collect-Artifact -SourceDir "$UserPath" -FileMask "Current Tabs" -FolderName "Chrome_Current_Tabs"

# 22. Chrome Current Tabs
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\"
Collect-Artifact -SourceDir "$UserPath" -FileMask "Current Tabs" -FolderName "Chrome_Current_Tabs"

# 23. Chrome Download Metadata
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\"
Collect-Artifact -SourceDir "$UserPath" -FileMask "Download Metadata" -FolderName "Chrome_Download_Metadata"

# 24. Chrome Download Metadata
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\"
Collect-Artifact -SourceDir "$UserPath" -FileMask "Download Metadata" -FolderName "Chrome_Download_Metadata"

# 25. Chrome Extension Cookies
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\"
Collect-Artifact -SourceDir "$UserPath" -FileMask "Extension Cookies" -FolderName "Chrome_Extension_Cookies"

# 26. Chrome Extension Cookies
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\"
Collect-Artifact -SourceDir "$UserPath" -FileMask "Extension Cookies" -FolderName "Chrome_Extension_Cookies"

# 27. Chrome Favicons
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\"
Collect-Artifact -SourceDir "$UserPath" -FileMask "Favicons*" -FolderName "Chrome_Favicons"

# 28. Chrome Favicons
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\"
Collect-Artifact -SourceDir "$UserPath" -FileMask "Favicons*" -FolderName "Chrome_Favicons"

# 29. Chrome History
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\"
Collect-Artifact -SourceDir "$UserPath" -FileMask "History*" -FolderName "Chrome_History"

# 30. Chrome History
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\"
Collect-Artifact -SourceDir "$UserPath" -FileMask "History*" -FolderName "Chrome_History"

# 31. Chrome Last Session
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\"
Collect-Artifact -SourceDir "$UserPath" -FileMask "Last Session" -FolderName "Chrome_Last_Session"

# 32. Chrome Last Session
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\"
Collect-Artifact -SourceDir "$UserPath" -FileMask "Last Session" -FolderName "Chrome_Last_Session"

# 33. Chrome Last Tabs
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\"
Collect-Artifact -SourceDir "$UserPath" -FileMask "Last Tabs" -FolderName "Chrome_Last_Tabs"

# 34. Chrome Last Tabs
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\"
Collect-Artifact -SourceDir "$UserPath" -FileMask "Last Tabs" -FolderName "Chrome_Last_Tabs"

# 35. Chrome Sessions Folder
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\Sessions\"
Collect-Artifact -SourceDir "$UserPath" -FolderName "Chrome_Sessions_Folder"

# 36. Chrome Sessions Folder
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\Sessions\"
Collect-Artifact -SourceDir "$UserPath" -FolderName "Chrome_Sessions_Folder"

# 37. Chrome Login Data
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\"
Collect-Artifact -SourceDir "$UserPath" -FileMask "Login Data" -FolderName "Chrome_Login_Data"

# 38. Chrome Login Data
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\"
Collect-Artifact -SourceDir "$UserPath" -FileMask "Login Data" -FolderName "Chrome_Login_Data"

# 39. Chrome Media History
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\"
Collect-Artifact -SourceDir "$UserPath" -FileMask "Media History*" -FolderName "Chrome_Media_History"

# 40. Chrome Media History
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\"
Collect-Artifact -SourceDir "$UserPath" -FileMask "Media History*" -FolderName "Chrome_Media_History"

# 41. Chrome Network Action Predictor
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\"
Collect-Artifact -SourceDir "$UserPath" -FileMask "Network Action Predictor" -FolderName "Chrome_Network_Action_Predictor"

# 42. Chrome Network Action Predictor
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\"
Collect-Artifact -SourceDir "$UserPath" -FileMask "Network Action Predictor" -FolderName "Chrome_Network_Action_Predictor"

# 43. Chrome Network Persistent State
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\"
Collect-Artifact -SourceDir "$UserPath" -FileMask "Network Persistent State" -FolderName "Chrome_Network_Persistent_State"

# 44. Chrome Network Persistent State
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\"
Collect-Artifact -SourceDir "$UserPath" -FileMask "Network Persistent State" -FolderName "Chrome_Network_Persistent_State"

# 45. Chrome Preferences
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\"
Collect-Artifact -SourceDir "$UserPath" -FileMask "Preferences" -FolderName "Chrome_Preferences"

# 46. Chrome Preferences
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\"
Collect-Artifact -SourceDir "$UserPath" -FileMask "Preferences" -FolderName "Chrome_Preferences"

# 47. Chrome Quota Manager
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\"
Collect-Artifact -SourceDir "$UserPath" -FileMask "QuotaManager" -FolderName "Chrome_Quota_Manager"

# 48. Chrome Quota Manager
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\"
Collect-Artifact -SourceDir "$UserPath" -FileMask "QuotaManager" -FolderName "Chrome_Quota_Manager"

# 49. Chrome Reporting and NEL
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\"
Collect-Artifact -SourceDir "$UserPath" -FileMask "Reporting and NEL" -FolderName "Chrome_Reporting_and_NEL"

# 50. Chrome Reporting and NEL
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\"
Collect-Artifact -SourceDir "$UserPath" -FileMask "Reporting and NEL" -FolderName "Chrome_Reporting_and_NEL"

# 51. Chrome Shortcuts
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\"
Collect-Artifact -SourceDir "$UserPath" -FileMask "Shortcuts*" -FolderName "Chrome_Shortcuts"

# 52. Chrome Shortcuts
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\"
Collect-Artifact -SourceDir "$UserPath" -FileMask "Shortcuts*" -FolderName "Chrome_Shortcuts"

# 53. Chrome Top Sites
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\"
Collect-Artifact -SourceDir "$UserPath" -FileMask "Top Sites*" -FolderName "Chrome_Top_Sites"

# 54. Chrome Top Sites
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\"
Collect-Artifact -SourceDir "$UserPath" -FileMask "Top Sites*" -FolderName "Chrome_Top_Sites"

# 55. Chrome Trust Tokens
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\"
Collect-Artifact -SourceDir "$UserPath" -FileMask "Trust Tokens*" -FolderName "Chrome_Trust_Tokens"

# 56. Chrome Trust Tokens
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\"
Collect-Artifact -SourceDir "$UserPath" -FileMask "Trust Tokens*" -FolderName "Chrome_Trust_Tokens"

# 57. Chrome SyncData Database
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\Sync Data"
Collect-Artifact -SourceDir "$UserPath" -FileMask "SyncData.sqlite3" -FolderName "Chrome_SyncData_Database"

# 58. Chrome SyncData Database
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\Sync Data"
Collect-Artifact -SourceDir "$UserPath" -FileMask "SyncData.sqlite3" -FolderName "Chrome_SyncData_Database"

# 59. Chrome Visited Links
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\"
Collect-Artifact -SourceDir "$UserPath" -FileMask "Visited Links" -FolderName "Chrome_Visited_Links"

# 60. Chrome Visited Links
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\"
Collect-Artifact -SourceDir "$UserPath" -FileMask "Visited Links" -FolderName "Chrome_Visited_Links"

# 61. Chrome Web Data
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\"
Collect-Artifact -SourceDir "$UserPath" -FileMask "Web Data*" -FolderName "Chrome_Web_Data"

# 62. Chrome Web Data
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\"
Collect-Artifact -SourceDir "$UserPath" -FileMask "Web Data*" -FolderName "Chrome_Web_Data"

# 63. Windows Protect Folder
$UserPath = Join-Path $env:USERPROFILE "AppData\Roaming\Microsoft\Protect\*\"
Collect-Artifact -SourceDir "$UserPath" -FolderName "Windows_Protect_Folder"

# 64. Windows Protect Folder
$UserPath = Join-Path $env:USERPROFILE "AppData\Roaming\Microsoft\Protect\*\"
Collect-Artifact -SourceDir "$UserPath" -FolderName "Windows_Protect_Folder"

# 65. Edge folder
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\"
Collect-Artifact -SourceDir "$UserPath" -FolderName "Edge_folder"

# 66. Edge folder
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\"
Collect-Artifact -SourceDir "$UserPath" -FolderName "Edge_folder"

# 67. Amcache
Collect-Artifact -SourceDir "C:\" -FileMask "Amcache.hve" -FolderName "Amcache"

# 68. Amcache transaction files
Collect-Artifact -SourceDir "C:\" -FileMask "Amcache.hve.LOG*" -FolderName "Amcache_transaction_files"

# 69. LNK Files from Recent
$UserPath = Join-Path $env:USERPROFILE "AppData\Roaming\Microsoft\Windows\Recent\"
Collect-Artifact -SourceDir "$UserPath" -FolderName "LNK_Files_from_Recent"

# 70. LNK Files from Recent
$UserPath = Join-Path $env:USERPROFILE "AppData\Roaming\Microsoft\Windows\Recent\"
Collect-Artifact -SourceDir "$UserPath" -FolderName "LNK_Files_from_Recent"

# 71. LNK Files from Microsoft Office Recent
$UserPath = Join-Path $env:USERPROFILE "AppData\Roaming\Microsoft\Office\Recent\"
Collect-Artifact -SourceDir "$UserPath" -FolderName "LNK_Files_from_Microsoft_Office_Recent"

# 72. LNK Files from Microsoft Office Recent
$UserPath = Join-Path $env:USERPROFILE "AppData\Roaming\Microsoft\Office\Recent\"
Collect-Artifact -SourceDir "$UserPath" -FolderName "LNK_Files_from_Microsoft_Office_Recent"

# 73. Desktop LNK Files
Collect-Artifact -SourceDir "C:\" -FileMask "*.LNK" -FolderName "Desktop_LNK_Files"

Write-Host "Collection complete!" -ForegroundColor Green
› Save as .ps1 and run as Administrator. Use: powershell -ExecutionPolicy Bypass -File script.ps1
› cyberchef recipes
Open in CyberChef to decode values extracted from this artifact.
// description

// paths

// collection commands

description

paths

collection commands
