DFIRHub

SiemensTIA

Appsv1

Author: Olaf Schwarz (@b00010111)

Copy Siemens TIA Settings

Paths

1 path
Paths use Windows environment variable syntax

Notes

The Settings.xml file contains information about opened project files, last storge location used and so on.

You can find more info on the Settings.xml file in part 2 of this blog post series: https://blog.nviso.eu/series/investigating-an-engineering-workstation/

There is a tool available to parse the Settings.xml file: https://github.com/00010111/parse_tSettings The verbose output also provides information on the content of the Settings.xml file

Collection commands

# PowerShell Artifact Collection Script
# Target: SiemensTIA
# Run as Administrator

#Requires -RunAsAdministrator

$ErrorActionPreference = "Continue"
$SourceRoot = "C:"
$DestBase   = "D:\Evidence"
$Summary = @{ Copied = 0; Missed = 0; Errors = 0 }

function Collect-Artifact {
    param(
        [Parameter(Mandatory)][string]$SourceDir,
        [Parameter(Mandatory)][string]$FolderName,
        [string]$FileMask = "*"
    )
    # Expand wildcards in any path segment (e.g. 'Program Files*',
    # 'ScreenConnect Client*'). robocopy itself does not glob the source.
    $sources = @(Get-Item -Path $SourceDir -ErrorAction SilentlyContinue |
        Where-Object { $_.PSIsContainer })
    if ($sources.Count -eq 0) {
        $Summary.Missed++
        return
    }
    $FullDest = Join-Path -Path $DestBase -ChildPath $FolderName
    $null = New-Item -ItemType Directory -Force -Path $FullDest -ErrorAction SilentlyContinue
    foreach ($src in $sources) {
        robocopy $src.FullName "$FullDest" "$FileMask" /E /COPY:DAT /R:0 /W:0 /NP /NFL /NDL /NJH /NJS 2>$null | Out-Null
        if ($LASTEXITCODE -le 7) { $Summary.Copied++ } else { $Summary.Errors++ }
    }
}

# Iterate every user profile under the source drive
Get-ChildItem "$SourceRoot\Users" -Directory -ErrorAction SilentlyContinue |
    Where-Object { $_.Name -notin @('All Users', 'Default', 'Default User', 'Public') } |
    ForEach-Object {
        $UserName = $_.Name
        # Siemens TIA Settings
        $UserPath = "$($_.FullName)\AppData\Roaming\Siemens\Automation\Portal*\Settings"
        Collect-Artifact -SourceDir $UserPath -FolderName "Siemens_TIA_Settings_$UserName"
    }

Write-Host ("Collection complete. Copied: {0}  Missed: {1}  Errors: {2}" -f $Summary.Copied, $Summary.Missed, $Summary.Errors) -ForegroundColor Green

Save as .ps1 and run as Administrator. Use: powershell -ExecutionPolicy Bypass -File script.ps1