RoamingProfile

Windowsv1.1

Author: Scott Downie

description

User Related Registry Hives, LNK files, etc

paths

73 paths

RegistryNTUSER.DAT registry hive

C:\NTUSER.DAT

RegistryNTUSER.DAT registry transaction files

C:\NTUSER.DAT.LOG*

RegistryNTUSER.DAT DEFAULT registry hive

C:\DEFAULT

RegistryNTUSER.DAT DEFAULT transaction files

C:\DEFAULT.LOG*

RegistryUsrClass.dat registry hive

C:\UsrClass.dat

RegistryUsrClass.dat registry transaction files

C:\UsrClass.dat.LOG*

LNKFilesLNK Files

C:\*.LNK

FileKnowledgeWord Autosave Location

C:\Users\%user%\AppData\Roaming\Microsoft\Word\

ApplicationCompatibilityExcel Autosave Location

C:\Users\%user%\AppData\Roaming\Microsoft\Excel\

FileKnowledgePowerPoint Autosave Location

C:\Users\%user%\AppData\Roaming\Microsoft\PowerPoint\

FileKnowledgePublisher Autosave Location

C:\Users\%user%\AppData\Roaming\Microsoft\Publisher\

FileKnowledgePublisher Autosave Location

C:\Users\%user%\AppData\Roaming\Microsoft\Word\

FileKnowledgeOffice Document Cache

C:\Users\%user%\AppData\Local\Microsoft\Office\*\OfficeFileCache\

FileKnowledgeOffice Document Cache

C:\Users\%user%\AppData\Local\Microsoft\Office\*\OfficeFileCache\

CommunicationsChrome bookmarks

C:\Users\%user%\AppData\Local\Google\Chrome\User Data\*\Bookmarks*

CommunicationsChrome bookmarks

C:\Users\%user%\AppData\Local\Google\Chrome\User Data\*\Bookmarks*

CommunicationsChrome Cookies

C:\Users\%user%\AppData\Local\Google\Chrome\User Data\*\Cookies*

CommunicationsChrome Cookies

C:\Users\%user%\AppData\Local\Google\Chrome\User Data\*\Cookies*

CommunicationsChrome Current Session

C:\Users\%user%\AppData\Local\Google\Chrome\User Data\*\Current Session

CommunicationsChrome Current Session

C:\Users\%user%\AppData\Local\Google\Chrome\User Data\*\Current Session

CommunicationsChrome Current Tabs

C:\Users\%user%\AppData\Local\Google\Chrome\User Data\*\Current Tabs

CommunicationsChrome Current Tabs

C:\Users\%user%\AppData\Local\Google\Chrome\User Data\*\Current Tabs

CommunicationsChrome Download Metadata

C:\Users\%user%\AppData\Local\Google\Chrome\User Data\*\Download Metadata

CommunicationsChrome Download Metadata

C:\Users\%user%\AppData\Local\Google\Chrome\User Data\*\Download Metadata

CommunicationsChrome Extension Cookies

C:\Users\%user%\AppData\Local\Google\Chrome\User Data\*\Extension Cookies

CommunicationsChrome Extension Cookies

C:\Users\%user%\AppData\Local\Google\Chrome\User Data\*\Extension Cookies

CommunicationsChrome Favicons

C:\Users\%user%\AppData\Local\Google\Chrome\User Data\*\Favicons*

CommunicationsChrome Favicons

C:\Users\%user%\AppData\Local\Google\Chrome\User Data\*\Favicons*

CommunicationsChrome History

C:\Users\%user%\AppData\Local\Google\Chrome\User Data\*\History*

CommunicationsChrome History

C:\Users\%user%\AppData\Local\Google\Chrome\User Data\*\History*

CommunicationsChrome Last Session

C:\Users\%user%\AppData\Local\Google\Chrome\User Data\*\Last Session

CommunicationsChrome Last Session

C:\Users\%user%\AppData\Local\Google\Chrome\User Data\*\Last Session

CommunicationsChrome Last Tabs

C:\Users\%user%\AppData\Local\Google\Chrome\User Data\*\Last Tabs

CommunicationsChrome Last Tabs

C:\Users\%user%\AppData\Local\Google\Chrome\User Data\*\Last Tabs

CommunicationsChrome Sessions Folder

C:\Users\%user%\AppData\Local\Google\Chrome\User Data\*\Sessions\

CommunicationsChrome Sessions Folder

C:\Users\%user%\AppData\Local\Google\Chrome\User Data\*\Sessions\

CommunicationsChrome Login Data

C:\Users\%user%\AppData\Local\Google\Chrome\User Data\*\Login Data

CommunicationsChrome Login Data

C:\Users\%user%\AppData\Local\Google\Chrome\User Data\*\Login Data

CommunicationsChrome Media History

C:\Users\%user%\AppData\Local\Google\Chrome\User Data\*\Media History*

CommunicationsChrome Media History

C:\Users\%user%\AppData\Local\Google\Chrome\User Data\*\Media History*

CommunicationsChrome Network Action Predictor

C:\Users\%user%\AppData\Local\Google\Chrome\User Data\*\Network Action Predictor

CommunicationsChrome Network Action Predictor

C:\Users\%user%\AppData\Local\Google\Chrome\User Data\*\Network Action Predictor

CommunicationsChrome Network Persistent State

C:\Users\%user%\AppData\Local\Google\Chrome\User Data\*\Network Persistent State

CommunicationsChrome Network Persistent State

C:\Users\%user%\AppData\Local\Google\Chrome\User Data\*\Network Persistent State

CommunicationsChrome Preferences

C:\Users\%user%\AppData\Local\Google\Chrome\User Data\*\Preferences

CommunicationsChrome Preferences

C:\Users\%user%\AppData\Local\Google\Chrome\User Data\*\Preferences

CommunicationsChrome Quota Manager

C:\Users\%user%\AppData\Local\Google\Chrome\User Data\*\QuotaManager

CommunicationsChrome Quota Manager

C:\Users\%user%\AppData\Local\Google\Chrome\User Data\*\QuotaManager

CommunicationsChrome Reporting and NEL

C:\Users\%user%\AppData\Local\Google\Chrome\User Data\*\Reporting and NEL

CommunicationsChrome Reporting and NEL

C:\Users\%user%\AppData\Local\Google\Chrome\User Data\*\Reporting and NEL

CommunicationsChrome Shortcuts

C:\Users\%user%\AppData\Local\Google\Chrome\User Data\*\Shortcuts*

CommunicationsChrome Shortcuts

C:\Users\%user%\AppData\Local\Google\Chrome\User Data\*\Shortcuts*

CommunicationsChrome Top Sites

C:\Users\%user%\AppData\Local\Google\Chrome\User Data\*\Top Sites*

CommunicationsChrome Top Sites

C:\Users\%user%\AppData\Local\Google\Chrome\User Data\*\Top Sites*

CommunicationsChrome Trust Tokens

C:\Users\%user%\AppData\Local\Google\Chrome\User Data\*\Trust Tokens*

CommunicationsChrome Trust Tokens

C:\Users\%user%\AppData\Local\Google\Chrome\User Data\*\Trust Tokens*

CommunicationsChrome SyncData Database

C:\Users\%user%\AppData\Local\Google\Chrome\User Data\*\Sync DataSyncData.sqlite3

CommunicationsChrome SyncData Database

C:\Users\%user%\AppData\Local\Google\Chrome\User Data\*\Sync DataSyncData.sqlite3

CommunicationsChrome Visited Links

C:\Users\%user%\AppData\Local\Google\Chrome\User Data\*\Visited Links

CommunicationsChrome Visited Links

C:\Users\%user%\AppData\Local\Google\Chrome\User Data\*\Visited Links

CommunicationsChrome Web Data

C:\Users\%user%\AppData\Local\Google\Chrome\User Data\*\Web Data*

CommunicationsChrome Web Data

C:\Users\%user%\AppData\Local\Google\Chrome\User Data\*\Web Data*

FileSystemWindows Protect Folder

C:\Users\%user%\AppData\Roaming\Microsoft\Protect\*\

Required for offline decryption

FileSystemWindows Protect Folder

C:\Users\%user%\AppData\Roaming\Microsoft\Protect\*\

Required for offline decryption

CommunicationsEdge folder

C:\Users\%user%\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\

CommunicationsEdge folder

C:\Users\%user%\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\

ApplicationCompatibilityAmcache

C:\Amcache.hve

ApplicationCompatibilityAmcache transaction files

C:\Amcache.hve.LOG*

LNKFilesLNK Files from Recent

C:\Users\%user%\AppData\Roaming\Microsoft\Windows\Recent\

LNKFilesLNK Files from Recent

C:\Users\%user%\AppData\Roaming\Microsoft\Windows\Recent\

LNKFilesLNK Files from Microsoft Office Recent

C:\Users\%user%\AppData\Roaming\Microsoft\Office\Recent\

LNKFilesLNK Files from Microsoft Office Recent

C:\Users\%user%\AppData\Roaming\Microsoft\Office\Recent\

LNKFilesDesktop LNK Files

C:\*.LNK

› paths use Windows environment syntax

collection commands

source:

destination:

# PowerShell Artifact Collection Script
# Target: RoamingProfile
# Run as Administrator

#Requires -RunAsAdministrator

$ErrorActionPreference = "SilentlyContinue"
$DestBase = "D:\Evidence"

# Function to handle directory creation and copying
function Collect-Artifact {
    param (
        [string]$SourcePath,
        [string]$FolderName
    )
    $FullDest = Join-Path -Path $DestBase -ChildPath $FolderName
    if (-not (Test-Path -Path $FullDest)) {
        New-Item -ItemType Directory -Path $FullDest -Force | Out-Null
    }
    Copy-Item -Path $SourcePath -Destination $FullDest -Recurse -Force
}

# 1. NTUSER.DAT registry hive
Collect-Artifact -SourcePath "C:\\NTUSER.DAT" -FolderName "NTUSER_DAT_registry_hive"

# 2. NTUSER.DAT registry transaction files
Collect-Artifact -SourcePath "C:\\NTUSER.DAT.LOG*" -FolderName "NTUSER_DAT_registry_transaction_files"

# 3. NTUSER.DAT DEFAULT registry hive
Collect-Artifact -SourcePath "C:\\DEFAULT" -FolderName "NTUSER_DAT_DEFAULT_registry_hive"

# 4. NTUSER.DAT DEFAULT transaction files
Collect-Artifact -SourcePath "C:\\DEFAULT.LOG*" -FolderName "NTUSER_DAT_DEFAULT_transaction_files"

# 5. UsrClass.dat registry hive
Collect-Artifact -SourcePath "C:\\UsrClass.dat" -FolderName "UsrClass_dat_registry_hive"

# 6. UsrClass.dat registry transaction files
Collect-Artifact -SourcePath "C:\\UsrClass.dat.LOG*" -FolderName "UsrClass_dat_registry_transaction_files"

# 7. LNK Files
Collect-Artifact -SourcePath "C:\\*.LNK" -FolderName "LNK_Files"

# 8. Word Autosave Location
$UserPath = Join-Path $env:USERPROFILE "AppData\Roaming\Microsoft\Word\"
Collect-Artifact -SourcePath "$UserPath\*" -FolderName "Word_Autosave_Location"

# 9. Excel Autosave Location
$UserPath = Join-Path $env:USERPROFILE "AppData\Roaming\Microsoft\Excel\"
Collect-Artifact -SourcePath "$UserPath\*" -FolderName "Excel_Autosave_Location"

# 10. PowerPoint Autosave Location
$UserPath = Join-Path $env:USERPROFILE "AppData\Roaming\Microsoft\PowerPoint\"
Collect-Artifact -SourcePath "$UserPath\*" -FolderName "PowerPoint_Autosave_Location"

# 11. Publisher Autosave Location
$UserPath = Join-Path $env:USERPROFILE "AppData\Roaming\Microsoft\Publisher\"
Collect-Artifact -SourcePath "$UserPath\*" -FolderName "Publisher_Autosave_Location"

# 12. Publisher Autosave Location
$UserPath = Join-Path $env:USERPROFILE "AppData\Roaming\Microsoft\Word\"
Collect-Artifact -SourcePath "$UserPath\*" -FolderName "Publisher_Autosave_Location"

# 13. Office Document Cache
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Microsoft\Office\*\OfficeFileCache\"
Collect-Artifact -SourcePath "$UserPath\*" -FolderName "Office_Document_Cache"

# 14. Office Document Cache
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Microsoft\Office\*\OfficeFileCache\"
Collect-Artifact -SourcePath "$UserPath\*" -FolderName "Office_Document_Cache"

# 15. Chrome bookmarks
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\"
Collect-Artifact -SourcePath "$UserPath\Bookmarks*" -FolderName "Chrome_bookmarks"

# 16. Chrome bookmarks
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\"
Collect-Artifact -SourcePath "$UserPath\Bookmarks*" -FolderName "Chrome_bookmarks"

# 17. Chrome Cookies
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\"
Collect-Artifact -SourcePath "$UserPath\Cookies*" -FolderName "Chrome_Cookies"

# 18. Chrome Cookies
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\"
Collect-Artifact -SourcePath "$UserPath\Cookies*" -FolderName "Chrome_Cookies"

# 19. Chrome Current Session
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\"
Collect-Artifact -SourcePath "$UserPath\Current Session" -FolderName "Chrome_Current_Session"

# 20. Chrome Current Session
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\"
Collect-Artifact -SourcePath "$UserPath\Current Session" -FolderName "Chrome_Current_Session"

# 21. Chrome Current Tabs
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\"
Collect-Artifact -SourcePath "$UserPath\Current Tabs" -FolderName "Chrome_Current_Tabs"

# 22. Chrome Current Tabs
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\"
Collect-Artifact -SourcePath "$UserPath\Current Tabs" -FolderName "Chrome_Current_Tabs"

# 23. Chrome Download Metadata
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\"
Collect-Artifact -SourcePath "$UserPath\Download Metadata" -FolderName "Chrome_Download_Metadata"

# 24. Chrome Download Metadata
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\"
Collect-Artifact -SourcePath "$UserPath\Download Metadata" -FolderName "Chrome_Download_Metadata"

# 25. Chrome Extension Cookies
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\"
Collect-Artifact -SourcePath "$UserPath\Extension Cookies" -FolderName "Chrome_Extension_Cookies"

# 26. Chrome Extension Cookies
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\"
Collect-Artifact -SourcePath "$UserPath\Extension Cookies" -FolderName "Chrome_Extension_Cookies"

# 27. Chrome Favicons
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\"
Collect-Artifact -SourcePath "$UserPath\Favicons*" -FolderName "Chrome_Favicons"

# 28. Chrome Favicons
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\"
Collect-Artifact -SourcePath "$UserPath\Favicons*" -FolderName "Chrome_Favicons"

# 29. Chrome History
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\"
Collect-Artifact -SourcePath "$UserPath\History*" -FolderName "Chrome_History"

# 30. Chrome History
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\"
Collect-Artifact -SourcePath "$UserPath\History*" -FolderName "Chrome_History"

# 31. Chrome Last Session
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\"
Collect-Artifact -SourcePath "$UserPath\Last Session" -FolderName "Chrome_Last_Session"

# 32. Chrome Last Session
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\"
Collect-Artifact -SourcePath "$UserPath\Last Session" -FolderName "Chrome_Last_Session"

# 33. Chrome Last Tabs
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\"
Collect-Artifact -SourcePath "$UserPath\Last Tabs" -FolderName "Chrome_Last_Tabs"

# 34. Chrome Last Tabs
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\"
Collect-Artifact -SourcePath "$UserPath\Last Tabs" -FolderName "Chrome_Last_Tabs"

# 35. Chrome Sessions Folder
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\Sessions\"
Collect-Artifact -SourcePath "$UserPath\*" -FolderName "Chrome_Sessions_Folder"

# 36. Chrome Sessions Folder
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\Sessions\"
Collect-Artifact -SourcePath "$UserPath\*" -FolderName "Chrome_Sessions_Folder"

# 37. Chrome Login Data
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\"
Collect-Artifact -SourcePath "$UserPath\Login Data" -FolderName "Chrome_Login_Data"

# 38. Chrome Login Data
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\"
Collect-Artifact -SourcePath "$UserPath\Login Data" -FolderName "Chrome_Login_Data"

# 39. Chrome Media History
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\"
Collect-Artifact -SourcePath "$UserPath\Media History*" -FolderName "Chrome_Media_History"

# 40. Chrome Media History
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\"
Collect-Artifact -SourcePath "$UserPath\Media History*" -FolderName "Chrome_Media_History"

# 41. Chrome Network Action Predictor
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\"
Collect-Artifact -SourcePath "$UserPath\Network Action Predictor" -FolderName "Chrome_Network_Action_Predictor"

# 42. Chrome Network Action Predictor
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\"
Collect-Artifact -SourcePath "$UserPath\Network Action Predictor" -FolderName "Chrome_Network_Action_Predictor"

# 43. Chrome Network Persistent State
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\"
Collect-Artifact -SourcePath "$UserPath\Network Persistent State" -FolderName "Chrome_Network_Persistent_State"

# 44. Chrome Network Persistent State
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\"
Collect-Artifact -SourcePath "$UserPath\Network Persistent State" -FolderName "Chrome_Network_Persistent_State"

# 45. Chrome Preferences
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\"
Collect-Artifact -SourcePath "$UserPath\Preferences" -FolderName "Chrome_Preferences"

# 46. Chrome Preferences
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\"
Collect-Artifact -SourcePath "$UserPath\Preferences" -FolderName "Chrome_Preferences"

# 47. Chrome Quota Manager
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\"
Collect-Artifact -SourcePath "$UserPath\QuotaManager" -FolderName "Chrome_Quota_Manager"

# 48. Chrome Quota Manager
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\"
Collect-Artifact -SourcePath "$UserPath\QuotaManager" -FolderName "Chrome_Quota_Manager"

# 49. Chrome Reporting and NEL
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\"
Collect-Artifact -SourcePath "$UserPath\Reporting and NEL" -FolderName "Chrome_Reporting_and_NEL"

# 50. Chrome Reporting and NEL
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\"
Collect-Artifact -SourcePath "$UserPath\Reporting and NEL" -FolderName "Chrome_Reporting_and_NEL"

# 51. Chrome Shortcuts
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\"
Collect-Artifact -SourcePath "$UserPath\Shortcuts*" -FolderName "Chrome_Shortcuts"

# 52. Chrome Shortcuts
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\"
Collect-Artifact -SourcePath "$UserPath\Shortcuts*" -FolderName "Chrome_Shortcuts"

# 53. Chrome Top Sites
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\"
Collect-Artifact -SourcePath "$UserPath\Top Sites*" -FolderName "Chrome_Top_Sites"

# 54. Chrome Top Sites
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\"
Collect-Artifact -SourcePath "$UserPath\Top Sites*" -FolderName "Chrome_Top_Sites"

# 55. Chrome Trust Tokens
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\"
Collect-Artifact -SourcePath "$UserPath\Trust Tokens*" -FolderName "Chrome_Trust_Tokens"

# 56. Chrome Trust Tokens
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\"
Collect-Artifact -SourcePath "$UserPath\Trust Tokens*" -FolderName "Chrome_Trust_Tokens"

# 57. Chrome SyncData Database
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\Sync Data"
Collect-Artifact -SourcePath "$UserPath\SyncData.sqlite3" -FolderName "Chrome_SyncData_Database"

# 58. Chrome SyncData Database
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\Sync Data"
Collect-Artifact -SourcePath "$UserPath\SyncData.sqlite3" -FolderName "Chrome_SyncData_Database"

# 59. Chrome Visited Links
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\"
Collect-Artifact -SourcePath "$UserPath\Visited Links" -FolderName "Chrome_Visited_Links"

# 60. Chrome Visited Links
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\"
Collect-Artifact -SourcePath "$UserPath\Visited Links" -FolderName "Chrome_Visited_Links"

# 61. Chrome Web Data
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\"
Collect-Artifact -SourcePath "$UserPath\Web Data*" -FolderName "Chrome_Web_Data"

# 62. Chrome Web Data
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Google\Chrome\User Data\*\"
Collect-Artifact -SourcePath "$UserPath\Web Data*" -FolderName "Chrome_Web_Data"

# 63. Windows Protect Folder
$UserPath = Join-Path $env:USERPROFILE "AppData\Roaming\Microsoft\Protect\*\"
Collect-Artifact -SourcePath "$UserPath\*" -FolderName "Windows_Protect_Folder"

# 64. Windows Protect Folder
$UserPath = Join-Path $env:USERPROFILE "AppData\Roaming\Microsoft\Protect\*\"
Collect-Artifact -SourcePath "$UserPath\*" -FolderName "Windows_Protect_Folder"

# 65. Edge folder
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\"
Collect-Artifact -SourcePath "$UserPath\*" -FolderName "Edge_folder"

# 66. Edge folder
$UserPath = Join-Path $env:USERPROFILE "AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\"
Collect-Artifact -SourcePath "$UserPath\*" -FolderName "Edge_folder"

# 67. Amcache
Collect-Artifact -SourcePath "C:\\Amcache.hve" -FolderName "Amcache"

# 68. Amcache transaction files
Collect-Artifact -SourcePath "C:\\Amcache.hve.LOG*" -FolderName "Amcache_transaction_files"

# 69. LNK Files from Recent
$UserPath = Join-Path $env:USERPROFILE "AppData\Roaming\Microsoft\Windows\Recent\"
Collect-Artifact -SourcePath "$UserPath\*" -FolderName "LNK_Files_from_Recent"

# 70. LNK Files from Recent
$UserPath = Join-Path $env:USERPROFILE "AppData\Roaming\Microsoft\Windows\Recent\"
Collect-Artifact -SourcePath "$UserPath\*" -FolderName "LNK_Files_from_Recent"

# 71. LNK Files from Microsoft Office Recent
$UserPath = Join-Path $env:USERPROFILE "AppData\Roaming\Microsoft\Office\Recent\"
Collect-Artifact -SourcePath "$UserPath\*" -FolderName "LNK_Files_from_Microsoft_Office_Recent"

# 72. LNK Files from Microsoft Office Recent
$UserPath = Join-Path $env:USERPROFILE "AppData\Roaming\Microsoft\Office\Recent\"
Collect-Artifact -SourcePath "$UserPath\*" -FolderName "LNK_Files_from_Microsoft_Office_Recent"

# 73. Desktop LNK Files
Collect-Artifact -SourcePath "C:\\*.LNK" -FolderName "Desktop_LNK_Files"

Write-Host "Collection complete!" -ForegroundColor Green

› Save as .ps1 and run as Administrator. Use: powershell -ExecutionPolicy Bypass -File script.ps1

› cyberchef recipes

Open in CyberChef to decode values extracted from this artifact.

// description

// paths

// collection commands

description

paths

collection commands