dfirhub

Steam

Appsv1.1

Author: Nisarg Suthar, SolitudePy

description

Steam

paths

12 paths
AppsSteam Game Image files
C:\Program Files\Steam\appcache\librarycache\

Locates the directory containing image resources of installed/uninstalled games.

AppsSteam Login Metadata file
C:\Program Files\Steam\config\loginusers.vdf

Locates file containing Steam username and persona name.

AppsSteam Friend List and Username History file
C:\Program Files\Steam\userdata\*\config\localconfig.vdf

Locates file containing Steam Friend List and Username History.

AppsSteam User Avatar files
C:\Program Files\Steam\config\avatarcache\

Locates the directory containing avatar cache.

AppsSteam Game Tray Icon files
C:\Program Files\Steam\steam\games\

Locates the directory containing game icons appearing from tray menu.

AppsSteam Startup Times Log file
C:\Program Files\Steam\logs\bootstrap_log.txt

Locates the directory containing log for Steam startup times.

AppsSteam Game Image files
C:\Program Files (x86)\Steam\appcache\librarycache\

Locates the directory containing image resources of installed/uninstalled games.

AppsSteam Login Metadata file
C:\Program Files (x86)\Steam\config\loginusers.vdf

Locates file containing Steam username and persona name.

AppsSteam Friend List and Username History file
C:\Program Files (x86)\Steam\userdata\*\config\localconfig.vdf

Locates file containing Steam Friend List and Username History.

AppsSteam User Avatar files
C:\Program Files (x86)\Steam\config\avatarcache\

Locates the directory containing avatar cache.

AppsSteam Game Tray Icon files
C:\Program Files (x86)\Steam\steam\games\

Locates the directory containing game icons appearing from tray menu.

AppsSteam Startup Times Log file
C:\Program Files (x86)\Steam\logs\bootstrap_log.txt

Locates the directory containing log for Steam startup times.

› paths use Windows environment syntax

collection commands 

# PowerShell Artifact Collection Script
# Target: Steam
# Run as Administrator

#Requires -RunAsAdministrator

$ErrorActionPreference = "SilentlyContinue"
$DestBase = "D:\Evidence"

# Function to handle directory creation and copying
function Collect-Artifact {
    param (
        [string]$SourcePath,
        [string]$FolderName
    )
    $FullDest = Join-Path -Path $DestBase -ChildPath $FolderName
    if (-not (Test-Path -Path $FullDest)) {
        New-Item -ItemType Directory -Path $FullDest -Force | Out-Null
    }
    Copy-Item -Path $SourcePath -Destination $FullDest -Recurse -Force
}

# 1. Steam Game Image files
Collect-Artifact -SourcePath "C:\Program Files\Steam\appcache\librarycache\\*" -FolderName "Steam_Game_Image_files"

# 2. Steam Login Metadata file
Collect-Artifact -SourcePath "C:\Program Files\Steam\config\\loginusers.vdf" -FolderName "Steam_Login_Metadata_file"

# 3. Steam Friend List and Username History file
Collect-Artifact -SourcePath "C:\Program Files\Steam\userdata\*\config\\localconfig.vdf" -FolderName "Steam_Friend_List_and_Username_History_file"

# 4. Steam User Avatar files
Collect-Artifact -SourcePath "C:\Program Files\Steam\config\avatarcache\\*" -FolderName "Steam_User_Avatar_files"

# 5. Steam Game Tray Icon files
Collect-Artifact -SourcePath "C:\Program Files\Steam\steam\games\\*" -FolderName "Steam_Game_Tray_Icon_files"

# 6. Steam Startup Times Log file
Collect-Artifact -SourcePath "C:\Program Files\Steam\logs\\bootstrap_log.txt" -FolderName "Steam_Startup_Times_Log_file"

# 7. Steam Game Image files
Collect-Artifact -SourcePath "C:\Program Files (x86)\Steam\appcache\librarycache\\*" -FolderName "Steam_Game_Image_files"

# 8. Steam Login Metadata file
Collect-Artifact -SourcePath "C:\Program Files (x86)\Steam\config\\loginusers.vdf" -FolderName "Steam_Login_Metadata_file"

# 9. Steam Friend List and Username History file
Collect-Artifact -SourcePath "C:\Program Files (x86)\Steam\userdata\*\config\\localconfig.vdf" -FolderName "Steam_Friend_List_and_Username_History_file"

# 10. Steam User Avatar files
Collect-Artifact -SourcePath "C:\Program Files (x86)\Steam\config\avatarcache\\*" -FolderName "Steam_User_Avatar_files"

# 11. Steam Game Tray Icon files
Collect-Artifact -SourcePath "C:\Program Files (x86)\Steam\steam\games\\*" -FolderName "Steam_Game_Tray_Icon_files"

# 12. Steam Startup Times Log file
Collect-Artifact -SourcePath "C:\Program Files (x86)\Steam\logs\\bootstrap_log.txt" -FolderName "Steam_Startup_Times_Log_file"

Write-Host "Collection complete!" -ForegroundColor Green

› Save as .ps1 and run as Administrator. Use: powershell -ExecutionPolicy Bypass -File script.ps1