Thunderbird

# PowerShell Artifact Collection Script
# Target: Thunderbird
# Run as Administrator

#Requires -RunAsAdministrator

$ErrorActionPreference = "SilentlyContinue"
$DestBase = "D:\Evidence"

# Function to handle artifact collection with robocopy
function Collect-Artifact {
    param (
        [string]$SourceDir,
        [string]$FolderName,
        [string]$FileMask = "*"
    )
    $FullDest = Join-Path -Path $DestBase -ChildPath $FolderName
    robocopy "$SourceDir" "$FullDest" "$FileMask" /E /COPY:DAT /R:0 /W:0 /NP /NFL /NDL /NJH /NJS | Out-Null
}

# 1. Mozilla Thunderbird Install Date
$UserPath = Join-Path $env:USERPROFILE "AppData\Roaming\Thunderbird\Crash Reports\"
Collect-Artifact -SourceDir "$UserPath" -FileMask "InstallTime*" -FolderName "Mozilla_Thunderbird_Install_Date"

# 2. Mozilla Thunderbird Profiles.ini
$UserPath = Join-Path $env:USERPROFILE "AppData\Roaming\Thunderbird\"
Collect-Artifact -SourceDir "$UserPath" -FileMask "profiles.ini" -FolderName "Mozilla_Thunderbird_Profiles_ini"

# 3. Mozilla Thunderbird prefs.js
$UserPath = Join-Path $env:USERPROFILE "AppData\Roaming\Thunderbird\Profiles\*\"
Collect-Artifact -SourceDir "$UserPath" -FileMask "prefs.js" -FolderName "Mozilla_Thunderbird_prefs_js"

# 4. Mozilla Thunderbird Global Messages Database
$UserPath = Join-Path $env:USERPROFILE "AppData\Roaming\Thunderbird\Profiles\*\"
Collect-Artifact -SourceDir "$UserPath" -FileMask "global-messages-db.sqlite" -FolderName "Mozilla_Thunderbird_Global_Messages_Database"

# 5. Mozilla Thunderbird logins.json
$UserPath = Join-Path $env:USERPROFILE "AppData\Roaming\Thunderbird\Profiles\*\"
Collect-Artifact -SourceDir "$UserPath" -FileMask "logins.json" -FolderName "Mozilla_Thunderbird_logins_json"

# 6. Mozilla Thunderbird places.sqlite
$UserPath = Join-Path $env:USERPROFILE "AppData\Roaming\Thunderbird\Profiles\*\"
Collect-Artifact -SourceDir "$UserPath" -FileMask "places.sqlite" -FolderName "Mozilla_Thunderbird_places_sqlite"

# 7. Mozilla Thunderbird ImapMail INBOX
$UserPath = Join-Path $env:USERPROFILE "AppData\Roaming\Thunderbird\Profiles\*\ImapMail\"
Collect-Artifact -SourceDir "$UserPath" -FileMask "INBOX" -FolderName "Mozilla_Thunderbird_ImapMail_INBOX"

# 8. Mozilla Thunderbird Mail INBOX
$UserPath = Join-Path $env:USERPROFILE "AppData\Roaming\Thunderbird\Profiles\*\Mail\"
Collect-Artifact -SourceDir "$UserPath" -FileMask "INBOX" -FolderName "Mozilla_Thunderbird_Mail_INBOX"

# 9. Mozilla Thunderbird Calendar Data
$UserPath = Join-Path $env:USERPROFILE "AppData\Roaming\Thunderbird\Profiles\*\calendar-data\"
Collect-Artifact -SourceDir "$UserPath" -FileMask "local.sqlite" -FolderName "Mozilla_Thunderbird_Calendar_Data"

# 10. Mozilla Thunderbird Attachments
$UserPath = Join-Path $env:USERPROFILE "AppData\Roaming\Thunderbird\Profiles\*\Attachments\"
Collect-Artifact -SourceDir "$UserPath" -FolderName "Mozilla_Thunderbird_Attachments"

# 11. Mozilla Thunderbird Address Book
$UserPath = Join-Path $env:USERPROFILE "AppData\Roaming\Thunderbird\Profiles\*\"
Collect-Artifact -SourceDir "$UserPath" -FileMask "abook.sqlite" -FolderName "Mozilla_Thunderbird_Address_Book"

Write-Host "Collection complete!" -ForegroundColor Green