dfirhub

VisualStudioCode

Appsv2

Author: Sebastian Søgaard, ogmini

description

Visual Studio Code artifacts

paths

9 paths
AppsVSCode Opened Files
C:\Users\%user%\AppData\Roaming\Code\User\History\*\

Grabs the files in the VSCode history. These are files the user has opened with VSCode

AppsVSCode Workspaces
C:\Users\%user%\AppData\Roaming\Code\User\globalStorage\storage.json*

Grabs the file containing information about the user's workspaces

AppsVSCode User extensions
C:\Users\%user%\AppData\Roaming\Code\CachedExtensions\user*

Grabs the files relating to the user's installed extensions

AppsVSCode User settings
C:\Users\%user%\AppData\Roaming\Code\User\settings.json*

Grabs the file containing the settings the user has set.

AppsVSCode User Preferences
C:\Users\%user%\AppData\Roaming\Code\preferences*

Grabs the file containing the preferences the user has set.

AppsVSCode Network Cookies
C:\Users\%user%\AppData\Roaming\Code\Network\Cookies*

Grabs the cookie files. Same format as Chromium Cookies

AppsVSCode Network Persistent State
C:\Users\%user%\AppData\Roaming\Code\Network\Network Persistent State*

Grabs the Network Persistent State file. Same format as in Chromium

AppsVSCode Logs
C:\Users\%user%\AppData\Roaming\Code\logs\

Grabs the VSCode logs. Further analysis is needed to determine which logs are junk, and which can be vital.

AppsVSCode File Backups
C:\Users\%user%\AppData\Roaming\Code\Backups\*\

Grabs the Backups for unsaved changes.

› paths use Windows environment syntax

collection commands 

# PowerShell Artifact Collection Script
# Target: VisualStudioCode
# Run as Administrator

#Requires -RunAsAdministrator

$ErrorActionPreference = "SilentlyContinue"
$DestBase = "D:\Evidence"

# Function to handle directory creation and copying
function Collect-Artifact {
    param (
        [string]$SourcePath,
        [string]$FolderName
    )
    $FullDest = Join-Path -Path $DestBase -ChildPath $FolderName
    if (-not (Test-Path -Path $FullDest)) {
        New-Item -ItemType Directory -Path $FullDest -Force | Out-Null
    }
    Copy-Item -Path $SourcePath -Destination $FullDest -Recurse -Force
}

# 1. VSCode Opened Files
$UserPath = Join-Path $env:USERPROFILE "AppData\Roaming\Code\User\History\*\"
Collect-Artifact -SourcePath "$UserPath\*" -FolderName "VSCode_Opened_Files"

# 2. VSCode Workspaces
$UserPath = Join-Path $env:USERPROFILE "AppData\Roaming\Code\User\globalStorage\"
Collect-Artifact -SourcePath "$UserPath\storage.json*" -FolderName "VSCode_Workspaces"

# 3. VSCode User extensions
$UserPath = Join-Path $env:USERPROFILE "AppData\Roaming\Code\CachedExtensions\"
Collect-Artifact -SourcePath "$UserPath\user*" -FolderName "VSCode_User_extensions"

# 4. VSCode User settings
$UserPath = Join-Path $env:USERPROFILE "AppData\Roaming\Code\User\"
Collect-Artifact -SourcePath "$UserPath\settings.json*" -FolderName "VSCode_User_settings"

# 5. VSCode User Preferences
$UserPath = Join-Path $env:USERPROFILE "AppData\Roaming\Code\"
Collect-Artifact -SourcePath "$UserPath\preferences*" -FolderName "VSCode_User_Preferences"

# 6. VSCode Network Cookies
$UserPath = Join-Path $env:USERPROFILE "AppData\Roaming\Code\Network\"
Collect-Artifact -SourcePath "$UserPath\Cookies*" -FolderName "VSCode_Network_Cookies"

# 7. VSCode Network Persistent State
$UserPath = Join-Path $env:USERPROFILE "AppData\Roaming\Code\Network\"
Collect-Artifact -SourcePath "$UserPath\Network Persistent State*" -FolderName "VSCode_Network_Persistent_State"

# 8. VSCode Logs
$UserPath = Join-Path $env:USERPROFILE "AppData\Roaming\Code\logs\"
Collect-Artifact -SourcePath "$UserPath\*" -FolderName "VSCode_Logs"

# 9. VSCode File Backups
$UserPath = Join-Path $env:USERPROFILE "AppData\Roaming\Code\Backups\*\"
Collect-Artifact -SourcePath "$UserPath\*" -FolderName "VSCode_File_Backups"

Write-Host "Collection complete!" -ForegroundColor Green

› Save as .ps1 and run as Administrator. Use: powershell -ExecutionPolicy Bypass -File script.ps1

references