WebBrowsers
Compoundv1.4
Author: Eric Zimmerman
description
Web browser history, bookmarks, etc.
includes (25)
+
5
more targets
paths
720 pathsfrom 25 targets
› paths use Windows environment syntax
collection commands
# PowerShell Artifact Collection Script
# Target: WebBrowsers
# Run as Administrator
#Requires -RunAsAdministrator
$ErrorActionPreference = "Continue"
$SourceRoot = "C:"
$DestBase = "D:\Evidence"
$Summary = @{ Copied = 0; Missed = 0; Errors = 0 }
function Collect-Artifact {
param(
[Parameter(Mandatory)][string]$SourceDir,
[Parameter(Mandatory)][string]$FolderName,
[string]$FileMask = "*"
)
# Expand wildcards in any path segment (e.g. 'Program Files*',
# 'ScreenConnect Client*'). robocopy itself does not glob the source.
$sources = @(Get-Item -Path $SourceDir -ErrorAction SilentlyContinue |
Where-Object { $_.PSIsContainer })
if ($sources.Count -eq 0) {
$Summary.Missed++
return
}
$FullDest = Join-Path -Path $DestBase -ChildPath $FolderName
$null = New-Item -ItemType Directory -Force -Path $FullDest -ErrorAction SilentlyContinue
foreach ($src in $sources) {
robocopy $src.FullName "$FullDest" "$FileMask" /E /COPY:DAT /R:0 /W:0 /NP /NFL /NDL /NJH /NJS 2>$null | Out-Null
if ($LASTEXITCODE -le 7) { $Summary.Copied++ } else { $Summary.Errors++ }
}
}
# 1. SYSTEM Chrome History
Collect-Artifact -SourceDir "C:\Windows\system32\config\systemprofile\AppData\Local\Google\Chrome\User Data\*" -FileMask "History*" -FolderName "SYSTEM_Chrome_History"
# 2. SYSTEM Chrome Beta History
Collect-Artifact -SourceDir "C:\Windows\system32\config\systemprofile\AppData\Local\Google\Chrome Beta\User Data\*" -FileMask "History*" -FolderName "SYSTEM_Chrome_Beta_History"
# 3. SYSTEM Chrome Dev History
Collect-Artifact -SourceDir "C:\Windows\system32\config\systemprofile\AppData\Local\Google\Chrome Dev\User Data\*" -FileMask "History*" -FolderName "SYSTEM_Chrome_Dev_History"
# 4. SYSTEM Chrome SxS History
Collect-Artifact -SourceDir "C:\Windows\system32\config\systemprofile\AppData\Local\Google\Chrome SxS\User Data\*" -FileMask "History*" -FolderName "SYSTEM_Chrome_SxS_History"
# 5. SYSTEM Chromium History
Collect-Artifact -SourceDir "C:\Windows\system32\config\systemprofile\AppData\Local\Chromium\User Data\*" -FileMask "History*" -FolderName "SYSTEM_Chromium_History"
# 6. SYSTEM Chrome History
Collect-Artifact -SourceDir "C:\Windows\system32\config\systemprofile\AppData\Local\Palo Alto Networks\PrismaAccessBrowser\User Data\*" -FileMask "History*" -FolderName "SYSTEM_Chrome_History"
# 7. SYSTEM Supermium History
Collect-Artifact -SourceDir "C:\Windows\system32\config\systemprofile\AppData\Local\Supermium\User Data\*" -FileMask "History*" -FolderName "SYSTEM_Supermium_History"
# 8. SYSTEM WaveBrowser History
Collect-Artifact -SourceDir "C:\Windows\system32\config\systemprofile\AppData\Local\WaveBrowser\User Data\*" -FileMask "History*" -FolderName "SYSTEM_WaveBrowser_History"
# Iterate every user profile under the source drive
Get-ChildItem "$SourceRoot\Users" -Directory -ErrorAction SilentlyContinue |
Where-Object { $_.Name -notin @('All Users', 'Default', 'Default User', 'Public') } |
ForEach-Object {
$UserName = $_.Name
# 360 Secure Browser Bookmarks
$UserPath = "$($_.FullName)\AppData\Roaming\360se6\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "360Bookmarks*" -FolderName "360_Secure_Browser_Bookmarks_$UserName"
# 360 Secure Browser Cookies
$UserPath = "$($_.FullName)\AppData\Roaming\360se6\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Cookies*" -FolderName "360_Secure_Browser_Cookies_$UserName"
# 360 Secure Browser Current Session
$UserPath = "$($_.FullName)\AppData\Roaming\360se6\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Current Session" -FolderName "360_Secure_Browser_Current_Session_$UserName"
# 360 Secure Browser Current Tabs
$UserPath = "$($_.FullName)\AppData\Roaming\360se6\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Current Tabs" -FolderName "360_Secure_Browser_Current_Tabs_$UserName"
# 360 Secure Browser Download Metadata
$UserPath = "$($_.FullName)\AppData\Roaming\360se6\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "DownloadMetadata" -FolderName "360_Secure_Browser_Download_Metadata_$UserName"
# 360 Secure Browser Extension Cookies
$UserPath = "$($_.FullName)\AppData\Roaming\360se6\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Extension Cookies" -FolderName "360_Secure_Browser_Extension_Cookies_$UserName"
# 360 Secure Browser Favicons
$UserPath = "$($_.FullName)\AppData\Roaming\360se6\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Favicons*" -FolderName "360_Secure_Browser_Favicons_$UserName"
# 360 Secure Browser History
$UserPath = "$($_.FullName)\AppData\Roaming\360se6\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "360History*" -FolderName "360_Secure_Browser_History_$UserName"
# 360 Secure Browser Last Session
$UserPath = "$($_.FullName)\AppData\Roaming\360se6\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Last Session" -FolderName "360_Secure_Browser_Last_Session_$UserName"
# 360 Secure Browser Last Tabs
$UserPath = "$($_.FullName)\AppData\Roaming\360se6\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Last Tabs" -FolderName "360_Secure_Browser_Last_Tabs_$UserName"
# 360 Secure Browser Sessions Folder
$UserPath = "$($_.FullName)\AppData\Roaming\360se6\User Data\*\Sessions"
Collect-Artifact -SourceDir $UserPath -FolderName "360_Secure_Browser_Sessions_Folder_$UserName"
# 360 Secure Browser Login Data
$UserPath = "$($_.FullName)\AppData\Roaming\360se6\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Login Data*" -FolderName "360_Secure_Browser_Login_Data_$UserName"
# 360 Secure Browser Media History
$UserPath = "$($_.FullName)\AppData\Roaming\360se6\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Media History*" -FolderName "360_Secure_Browser_Media_History_$UserName"
# 360 Secure Browser Network Action Predictor
$UserPath = "$($_.FullName)\AppData\Roaming\360se6\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Network Action Predictor" -FolderName "360_Secure_Browser_Network_Action_Predictor_$UserName"
# 360 Secure Browser Network Persistent State
$UserPath = "$($_.FullName)\AppData\Roaming\360se6\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Network Persistent State" -FolderName "360_Secure_Browser_Network_Persistent_State_$UserName"
# 360 Secure Browser Preferences
$UserPath = "$($_.FullName)\AppData\Roaming\360se6\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Preferences" -FolderName "360_Secure_Browser_Preferences_$UserName"
# 360 Secure Browser Secure Preferences
$UserPath = "$($_.FullName)\AppData\Roaming\360se6\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Secure Preferences" -FolderName "360_Secure_Browser_Secure_Preferences_$UserName"
# 360 Secure Browser Quota Manager
$UserPath = "$($_.FullName)\AppData\Roaming\360se6\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "QuotaManager" -FolderName "360_Secure_Browser_Quota_Manager_$UserName"
# 360 Secure Browser Reporting and NEL
$UserPath = "$($_.FullName)\AppData\Roaming\360se6\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Reporting and NEL" -FolderName "360_Secure_Browser_Reporting_and_NEL_$UserName"
# 360 Secure Browser Shortcuts
$UserPath = "$($_.FullName)\AppData\Roaming\360se6\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Shortcuts*" -FolderName "360_Secure_Browser_Shortcuts_$UserName"
# 360 Secure Browser Top Sites
$UserPath = "$($_.FullName)\AppData\Roaming\360se6\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Top Sites*" -FolderName "360_Secure_Browser_Top_Sites_$UserName"
# 360 Secure Browser Trust Tokens
$UserPath = "$($_.FullName)\AppData\Roaming\360se6\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Trust Tokens*" -FolderName "360_Secure_Browser_Trust_Tokens_$UserName"
# 360 Secure Browser SyncData Database
$UserPath = "$($_.FullName)\AppData\Roaming\360se6\User Data\*\Sync Data"
Collect-Artifact -SourceDir $UserPath -FolderName "360_Secure_Browser_SyncData_Database_$UserName"
# 360 Secure Browser Visited Links
$UserPath = "$($_.FullName)\AppData\Roaming\360se6\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Visited Links" -FolderName "360_Secure_Browser_Visited_Links_$UserName"
# 360 Secure Browser Web Data
$UserPath = "$($_.FullName)\AppData\Roaming\360se6\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Web Data*" -FolderName "360_Secure_Browser_Web_Data_$UserName"
# Windows Protect Folder
$UserPath = "$($_.FullName)\AppData\Roaming\Microsoft\Protect\*"
Collect-Artifact -SourceDir $UserPath -FolderName "Windows_Protect_Folder_$UserName"
# 360 Secure Browser Snapshots Folder
$UserPath = "$($_.FullName)\AppData\Roaming\360se6\User Data\Snapshots\*"
Collect-Artifact -SourceDir $UserPath -FolderName "360_Secure_Browser_Snapshots_Folder_$UserName"
# Arc Cookies
$UserPath = "$($_.FullName)\AppData\Local\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\*\Network"
Collect-Artifact -SourceDir $UserPath -FileMask "Cookies*" -FolderName "Arc_Cookies_$UserName"
# Arc Favicons
$UserPath = "$($_.FullName)\AppData\Local\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Favicons*" -FolderName "Arc_Favicons_$UserName"
# Arc History
$UserPath = "$($_.FullName)\AppData\Local\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "History*" -FolderName "Arc_History_$UserName"
# Arc Sessions Folder
$UserPath = "$($_.FullName)\AppData\Local\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\*\Sessions"
Collect-Artifact -SourceDir $UserPath -FolderName "Arc_Sessions_Folder_$UserName"
# Arc Login Data
$UserPath = "$($_.FullName)\AppData\Local\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Login Data*" -FolderName "Arc_Login_Data_$UserName"
# Arc Network Action Predictor
$UserPath = "$($_.FullName)\AppData\Local\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Network Action Predictor" -FolderName "Arc_Network_Action_Predictor_$UserName"
# Arc Preferences
$UserPath = "$($_.FullName)\AppData\Local\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Preferences" -FolderName "Arc_Preferences_$UserName"
# Arc Secure Preferences
$UserPath = "$($_.FullName)\AppData\Local\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Secure Preferences" -FolderName "Arc_Secure_Preferences_$UserName"
# Arc Shortcuts
$UserPath = "$($_.FullName)\AppData\Local\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Shortcuts*" -FolderName "Arc_Shortcuts_$UserName"
# Arc Top Sites
$UserPath = "$($_.FullName)\AppData\Local\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Top Sites*" -FolderName "Arc_Top_Sites_$UserName"
# Arc SyncData Database
$UserPath = "$($_.FullName)\AppData\Local\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\*\Sync Data"
Collect-Artifact -SourceDir $UserPath -FolderName "Arc_SyncData_Database_$UserName"
# Arc Bookmarks
$UserPath = "$($_.FullName)\AppData\Local\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Bookmarks*" -FolderName "Arc_Bookmarks_$UserName"
# Arc Visited Links
$UserPath = "$($_.FullName)\AppData\Local\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Visited Links" -FolderName "Arc_Visited_Links_$UserName"
# Arc Web Data
$UserPath = "$($_.FullName)\AppData\Local\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Web Data*" -FolderName "Arc_Web_Data_$UserName"
# Arc JSON Files
$UserPath = "$($_.FullName)\AppData\Local\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local\Arc"
Collect-Artifact -SourceDir $UserPath -FileMask "Storable*.json" -FolderName "Arc_JSON_Files_$UserName"
# Arc PLIST Files
$UserPath = "$($_.FullName)\AppData\Local\Packages\TheBrowserCompany.Arc_ttt1ap7aakyb4\LocalCache\Local"
Collect-Artifact -SourceDir $UserPath -FileMask "com*.plist" -FolderName "Arc_PLIST_Files_$UserName"
# Bookmarks
$UserPath = "$($_.FullName)\AppData\Local\BraveSoftware\Brave-Browser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Bookmarks*" -FolderName "Bookmarks_$UserName"
# Cookies
$UserPath = "$($_.FullName)\AppData\Local\BraveSoftware\Brave-Browser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Cookies*" -FolderName "Cookies_$UserName"
# Current Session
$UserPath = "$($_.FullName)\AppData\Local\BraveSoftware\Brave-Browser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Current Session" -FolderName "Current_Session_$UserName"
# Current Tabs
$UserPath = "$($_.FullName)\AppData\Local\BraveSoftware\Brave-Browser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Current Tabs" -FolderName "Current_Tabs_$UserName"
# Download Metadata
$UserPath = "$($_.FullName)\AppData\Local\BraveSoftware\Brave-Browser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "DownloadMetadata" -FolderName "Download_Metadata_$UserName"
# Favicons
$UserPath = "$($_.FullName)\AppData\Local\BraveSoftware\Brave-Browser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Favicons*" -FolderName "Favicons_$UserName"
# History
$UserPath = "$($_.FullName)\AppData\Local\BraveSoftware\Brave-Browser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "History*" -FolderName "History_$UserName"
# Sessions Folder
$UserPath = "$($_.FullName)\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Sessions"
Collect-Artifact -SourceDir $UserPath -FolderName "Sessions_Folder_$UserName"
# Login Data
$UserPath = "$($_.FullName)\AppData\Local\BraveSoftware\Brave-Browser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Login Data" -FolderName "Login_Data_$UserName"
# Network Action Predictor
$UserPath = "$($_.FullName)\AppData\Local\BraveSoftware\Brave-Browser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Network Action Predictor" -FolderName "Network_Action_Predictor_$UserName"
# Network Persistent State
$UserPath = "$($_.FullName)\AppData\Local\BraveSoftware\Brave-Browser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Network Persistent State" -FolderName "Network_Persistent_State_$UserName"
# Preferences
$UserPath = "$($_.FullName)\AppData\Local\BraveSoftware\Brave-Browser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Preferences" -FolderName "Preferences_$UserName"
# Quota Manager
$UserPath = "$($_.FullName)\AppData\Local\BraveSoftware\Brave-Browser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "QuotaManager" -FolderName "Quota_Manager_$UserName"
# Reporting and NEL
$UserPath = "$($_.FullName)\AppData\Local\BraveSoftware\Brave-Browser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Reporting and NEL" -FolderName "Reporting_and_NEL_$UserName"
# Shortcuts
$UserPath = "$($_.FullName)\AppData\Local\BraveSoftware\Brave-Browser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Shortcuts*" -FolderName "Shortcuts_$UserName"
# Publisher Info DB/Brave Rewards
$UserPath = "$($_.FullName)\AppData\Local\BraveSoftware\Brave-Browser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "publisher_info_db*" -FolderName "Publisher_Info_DB_Brave_Rewards_$UserName"
# Top Sites
$UserPath = "$($_.FullName)\AppData\Local\BraveSoftware\Brave-Browser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Top Sites*" -FolderName "Top_Sites_$UserName"
# Visited Links
$UserPath = "$($_.FullName)\AppData\Local\BraveSoftware\Brave-Browser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Visited Links*" -FolderName "Visited_Links_$UserName"
# Web Data
$UserPath = "$($_.FullName)\AppData\Local\BraveSoftware\Brave-Browser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Web Data*" -FolderName "Web_Data_$UserName"
# Secure Preferences
$UserPath = "$($_.FullName)\AppData\Local\BraveSoftware\Brave-Browser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Secure Preferences*" -FolderName "Secure_Preferences_$UserName"
# Chrome Bookmarks XP
$UserPath = "$($_.FullName)\Local Settings\Application Data\Google\Chrome\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Bookmarks*" -FolderName "Chrome_Bookmarks_XP_$UserName"
# Chrome Cookies XP
$UserPath = "$($_.FullName)\Local Settings\Application Data\Google\Chrome\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Cookies*" -FolderName "Chrome_Cookies_XP_$UserName"
# Chrome Current Session XP
$UserPath = "$($_.FullName)\Local Settings\Application Data\Google\Chrome\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Current Session" -FolderName "Chrome_Current_Session_XP_$UserName"
# Chrome Current Tabs XP
$UserPath = "$($_.FullName)\Local Settings\Application Data\Google\Chrome\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Current Tabs" -FolderName "Chrome_Current_Tabs_XP_$UserName"
# Chrome Favicons XP
$UserPath = "$($_.FullName)\Local Settings\Application Data\Google\Chrome\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Favicons*" -FolderName "Chrome_Favicons_XP_$UserName"
# Chrome History XP
$UserPath = "$($_.FullName)\Local Settings\Application Data\Google\Chrome\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "History*" -FolderName "Chrome_History_XP_$UserName"
# Chrome Last Session XP
$UserPath = "$($_.FullName)\Local Settings\Application Data\Google\Chrome\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Last Session" -FolderName "Chrome_Last_Session_XP_$UserName"
# Chrome Last Tabs XP
$UserPath = "$($_.FullName)\Local Settings\Application Data\Google\Chrome\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Last Tabs" -FolderName "Chrome_Last_Tabs_XP_$UserName"
# Chrome Login Data XP
$UserPath = "$($_.FullName)\Local Settings\Application Data\Google\Chrome\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Login Data" -FolderName "Chrome_Login_Data_XP_$UserName"
# Chrome Preferences XP
$UserPath = "$($_.FullName)\Local Settings\Application Data\Google\Chrome\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Preferences" -FolderName "Chrome_Preferences_XP_$UserName"
# Chrome Shortcuts XP
$UserPath = "$($_.FullName)\Local Settings\Application Data\Google\Chrome\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Shortcuts*" -FolderName "Chrome_Shortcuts_XP_$UserName"
# Chrome Top Sites XP
$UserPath = "$($_.FullName)\Local Settings\Application Data\Google\Chrome\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Top Sites*" -FolderName "Chrome_Top_Sites_XP_$UserName"
# Chrome Visited Links XP
$UserPath = "$($_.FullName)\Local Settings\Application Data\Google\Chrome\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Visited Links" -FolderName "Chrome_Visited_Links_XP_$UserName"
# Chrome Web Data XP
$UserPath = "$($_.FullName)\Local Settings\Application Data\Google\Chrome\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Web Data*" -FolderName "Chrome_Web_Data_XP_$UserName"
# Chrome Bookmarks
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Bookmarks*" -FolderName "Chrome_Bookmarks_$UserName"
# Chrome Cookies
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Cookies*" -FolderName "Chrome_Cookies_$UserName"
# Chrome Current Session
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Current Session" -FolderName "Chrome_Current_Session_$UserName"
# Chrome Current Tabs
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Current Tabs" -FolderName "Chrome_Current_Tabs_$UserName"
# Chrome Download Metadata
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "DownloadMetadata" -FolderName "Chrome_Download_Metadata_$UserName"
# Chrome Extension Cookies
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Extension Cookies*" -FolderName "Chrome_Extension_Cookies_$UserName"
# Chrome Favicons
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Favicons*" -FolderName "Chrome_Favicons_$UserName"
# Chrome History
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "History*" -FolderName "Chrome_History_$UserName"
# Chrome Last Session
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Last Session" -FolderName "Chrome_Last_Session_$UserName"
# Chrome Last Tabs
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Last Tabs" -FolderName "Chrome_Last_Tabs_$UserName"
# Chrome Sessions Folder
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome\User Data\*\Sessions"
Collect-Artifact -SourceDir $UserPath -FolderName "Chrome_Sessions_Folder_$UserName"
# Chrome Login Data
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Login Data*" -FolderName "Chrome_Login_Data_$UserName"
# Chrome Media History
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Media History*" -FolderName "Chrome_Media_History_$UserName"
# Chrome Network Action Predictor
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Network Action Predictor*" -FolderName "Chrome_Network_Action_Predictor_$UserName"
# Chrome Network Persistent State
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Network Persistent State" -FolderName "Chrome_Network_Persistent_State_$UserName"
# Chrome Network Persistent State
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome\User Data\*\Network"
Collect-Artifact -SourceDir $UserPath -FileMask "Network Persistent State" -FolderName "Chrome_Network_Persistent_State_$UserName"
# Chrome Preferences
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Preferences" -FolderName "Chrome_Preferences_$UserName"
# Chrome Quota Manager
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "QuotaManager*" -FolderName "Chrome_Quota_Manager_$UserName"
# Chrome Quota Manager
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome\User Data\*\WebStorage"
Collect-Artifact -SourceDir $UserPath -FileMask "QuotaManager*" -FolderName "Chrome_Quota_Manager_$UserName"
# Chrome Reporting and NEL
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Reporting and NEL*" -FolderName "Chrome_Reporting_and_NEL_$UserName"
# Chrome Reporting and NEL
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome\User Data\*\Network"
Collect-Artifact -SourceDir $UserPath -FileMask "Reporting and NEL*" -FolderName "Chrome_Reporting_and_NEL_$UserName"
# Chrome Shortcuts
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Shortcuts*" -FolderName "Chrome_Shortcuts_$UserName"
# Chrome Top Sites
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Top Sites*" -FolderName "Chrome_Top_Sites_$UserName"
# Chrome Trust Tokens
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Trust Tokens*" -FolderName "Chrome_Trust_Tokens_$UserName"
# Chrome Trust Tokens
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome\User Data\*\Network"
Collect-Artifact -SourceDir $UserPath -FileMask "Trust Tokens*" -FolderName "Chrome_Trust_Tokens_$UserName"
# Chrome SyncData Database
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome\User Data\*\Sync Data"
Collect-Artifact -SourceDir $UserPath -FileMask "SyncData.sqlite3" -FolderName "Chrome_SyncData_Database_$UserName"
# Chrome Visited Links
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Visited Links" -FolderName "Chrome_Visited_Links_$UserName"
# Chrome Web Data
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Web Data*" -FolderName "Chrome_Web_Data_$UserName"
# Chrome IndexedDB
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome\User Data\*\IndexedDB"
Collect-Artifact -SourceDir $UserPath -FolderName "Chrome_IndexedDB_$UserName"
# Chrome Local Storage
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome\User Data\*\Local Storage\leveldb"
Collect-Artifact -SourceDir $UserPath -FolderName "Chrome_Local_Storage_$UserName"
# Windows Protect Folder
$UserPath = "$($_.FullName)\AppData\Roaming\Microsoft\Protect\*"
Collect-Artifact -SourceDir $UserPath -FolderName "Windows_Protect_Folder_$UserName"
# Chrome Snapshots Folder
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome\User Data\Snapshots\*"
Collect-Artifact -SourceDir $UserPath -FolderName "Chrome_Snapshots_Folder_$UserName"
# Chrome Beta Bookmarks XP
$UserPath = "$($_.FullName)\Local Settings\Application Data\Google\Chrome Beta\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Bookmarks*" -FolderName "Chrome_Beta_Bookmarks_XP_$UserName"
# Chrome Beta Cookies XP
$UserPath = "$($_.FullName)\Local Settings\Application Data\Google\Chrome Beta\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Cookies*" -FolderName "Chrome_Beta_Cookies_XP_$UserName"
# Chrome Beta Current Session XP
$UserPath = "$($_.FullName)\Local Settings\Application Data\Google\Chrome Beta\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Current Session" -FolderName "Chrome_Beta_Current_Session_XP_$UserName"
# Chrome Beta Current Tabs XP
$UserPath = "$($_.FullName)\Local Settings\Application Data\Google\Chrome Beta\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Current Tabs" -FolderName "Chrome_Beta_Current_Tabs_XP_$UserName"
# Chrome Beta Favicons XP
$UserPath = "$($_.FullName)\Local Settings\Application Data\Google\Chrome Beta\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Favicons*" -FolderName "Chrome_Beta_Favicons_XP_$UserName"
# Chrome Beta History XP
$UserPath = "$($_.FullName)\Local Settings\Application Data\Google\Chrome Beta\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "History*" -FolderName "Chrome_Beta_History_XP_$UserName"
# Chrome Beta Last Session XP
$UserPath = "$($_.FullName)\Local Settings\Application Data\Google\Chrome Beta\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Last Session" -FolderName "Chrome_Beta_Last_Session_XP_$UserName"
# Chrome Beta Last Tabs XP
$UserPath = "$($_.FullName)\Local Settings\Application Data\Google\Chrome Beta\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Last Tabs" -FolderName "Chrome_Beta_Last_Tabs_XP_$UserName"
# Chrome Beta Login Data XP
$UserPath = "$($_.FullName)\Local Settings\Application Data\Google\Chrome Beta\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Login Data" -FolderName "Chrome_Beta_Login_Data_XP_$UserName"
# Chrome Beta Preferences XP
$UserPath = "$($_.FullName)\Local Settings\Application Data\Google\Chrome Beta\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Preferences" -FolderName "Chrome_Beta_Preferences_XP_$UserName"
# Chrome Beta Shortcuts XP
$UserPath = "$($_.FullName)\Local Settings\Application Data\Google\Chrome Beta\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Shortcuts*" -FolderName "Chrome_Beta_Shortcuts_XP_$UserName"
# Chrome Beta Top Sites XP
$UserPath = "$($_.FullName)\Local Settings\Application Data\Google\Chrome Beta\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Top Sites*" -FolderName "Chrome_Beta_Top_Sites_XP_$UserName"
# Chrome Beta Visited Links XP
$UserPath = "$($_.FullName)\Local Settings\Application Data\Google\Chrome Beta\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Visited Links" -FolderName "Chrome_Beta_Visited_Links_XP_$UserName"
# Chrome Beta Web Data XP
$UserPath = "$($_.FullName)\Local Settings\Application Data\Google\Chrome Beta\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Web Data*" -FolderName "Chrome_Beta_Web_Data_XP_$UserName"
# Chrome Beta Bookmarks
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome Beta\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Bookmarks*" -FolderName "Chrome_Beta_Bookmarks_$UserName"
# Chrome Beta Cookies
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome Beta\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Cookies*" -FolderName "Chrome_Beta_Cookies_$UserName"
# Chrome Beta Current Session
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome Beta\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Current Session" -FolderName "Chrome_Beta_Current_Session_$UserName"
# Chrome Beta Current Tabs
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome Beta\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Current Tabs" -FolderName "Chrome_Beta_Current_Tabs_$UserName"
# Chrome Beta Download Metadata
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome Beta\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "DownloadMetadata" -FolderName "Chrome_Beta_Download_Metadata_$UserName"
# Chrome Beta Extension Cookies
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome Beta\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Extension Cookies*" -FolderName "Chrome_Beta_Extension_Cookies_$UserName"
# Chrome Beta Favicons
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome Beta\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Favicons*" -FolderName "Chrome_Beta_Favicons_$UserName"
# Chrome Beta History
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome Beta\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "History*" -FolderName "Chrome_Beta_History_$UserName"
# Chrome Beta Last Session
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome Beta\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Last Session" -FolderName "Chrome_Beta_Last_Session_$UserName"
# Chrome Beta Last Tabs
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome Beta\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Last Tabs" -FolderName "Chrome_Beta_Last_Tabs_$UserName"
# Chrome Beta Sessions Folder
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome Beta\User Data\*\Sessions"
Collect-Artifact -SourceDir $UserPath -FolderName "Chrome_Beta_Sessions_Folder_$UserName"
# Chrome Beta Login Data
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome Beta\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Login Data*" -FolderName "Chrome_Beta_Login_Data_$UserName"
# Chrome Beta Media History
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome Beta\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Media History*" -FolderName "Chrome_Beta_Media_History_$UserName"
# Chrome Beta Network Action Predictor
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome Beta\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Network Action Predictor*" -FolderName "Chrome_Beta_Network_Action_Predictor_$UserName"
# Chrome Beta Network Persistent State
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome Beta\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Network Persistent State" -FolderName "Chrome_Beta_Network_Persistent_State_$UserName"
# Chrome Beta Network Persistent State
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome Beta\User Data\*\Network"
Collect-Artifact -SourceDir $UserPath -FileMask "Network Persistent State" -FolderName "Chrome_Beta_Network_Persistent_State_$UserName"
# Chrome Beta Preferences
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome Beta\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Preferences" -FolderName "Chrome_Beta_Preferences_$UserName"
# Chrome Beta Quota Manager
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome Beta\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "QuotaManager*" -FolderName "Chrome_Beta_Quota_Manager_$UserName"
# Chrome Beta Quota Manager
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome Beta\User Data\*\WebStorage"
Collect-Artifact -SourceDir $UserPath -FileMask "QuotaManager*" -FolderName "Chrome_Beta_Quota_Manager_$UserName"
# Chrome Beta Reporting and NEL
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome Beta\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Reporting and NEL*" -FolderName "Chrome_Beta_Reporting_and_NEL_$UserName"
# Chrome Beta Reporting and NEL
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome Beta\User Data\*\Network"
Collect-Artifact -SourceDir $UserPath -FileMask "Reporting and NEL*" -FolderName "Chrome_Beta_Reporting_and_NEL_$UserName"
# Chrome Beta Shortcuts
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome Beta\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Shortcuts*" -FolderName "Chrome_Beta_Shortcuts_$UserName"
# Chrome Beta Top Sites
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome Beta\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Top Sites*" -FolderName "Chrome_Beta_Top_Sites_$UserName"
# Chrome Beta Trust Tokens
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome Beta\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Trust Tokens*" -FolderName "Chrome_Beta_Trust_Tokens_$UserName"
# Chrome Beta Trust Tokens
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome Beta\User Data\*\Network"
Collect-Artifact -SourceDir $UserPath -FileMask "Trust Tokens*" -FolderName "Chrome_Beta_Trust_Tokens_$UserName"
# Chrome Beta SyncData Database
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome Beta\User Data\*\Sync Data"
Collect-Artifact -SourceDir $UserPath -FileMask "SyncData.sqlite3" -FolderName "Chrome_Beta_SyncData_Database_$UserName"
# Chrome Beta Visited Links
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome Beta\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Visited Links" -FolderName "Chrome_Beta_Visited_Links_$UserName"
# Chrome Beta Web Data
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome Beta\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Web Data*" -FolderName "Chrome_Beta_Web_Data_$UserName"
# Chrome Beta IndexedDB
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome Beta\User Data\*\IndexedDB"
Collect-Artifact -SourceDir $UserPath -FolderName "Chrome_Beta_IndexedDB_$UserName"
# Chrome Beta Local Storage
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome Beta\User Data\*\Local Storage\leveldb"
Collect-Artifact -SourceDir $UserPath -FolderName "Chrome_Beta_Local_Storage_$UserName"
# Windows Protect Folder
$UserPath = "$($_.FullName)\AppData\Roaming\Microsoft\Protect\*"
Collect-Artifact -SourceDir $UserPath -FolderName "Windows_Protect_Folder_$UserName"
# Chrome Beta Snapshots Folder
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome Beta\User Data\Snapshots\*"
Collect-Artifact -SourceDir $UserPath -FolderName "Chrome_Beta_Snapshots_Folder_$UserName"
# Chrome Dev Bookmarks XP
$UserPath = "$($_.FullName)\Local Settings\Application Data\Google\Chrome Dev\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Bookmarks*" -FolderName "Chrome_Dev_Bookmarks_XP_$UserName"
# Chrome Dev Cookies XP
$UserPath = "$($_.FullName)\Local Settings\Application Data\Google\Chrome Dev\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Cookies*" -FolderName "Chrome_Dev_Cookies_XP_$UserName"
# Chrome Dev Current Session XP
$UserPath = "$($_.FullName)\Local Settings\Application Data\Google\Chrome Dev\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Current Session" -FolderName "Chrome_Dev_Current_Session_XP_$UserName"
# Chrome Dev Current Tabs XP
$UserPath = "$($_.FullName)\Local Settings\Application Data\Google\Chrome Dev\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Current Tabs" -FolderName "Chrome_Dev_Current_Tabs_XP_$UserName"
# Chrome Dev Favicons XP
$UserPath = "$($_.FullName)\Local Settings\Application Data\Google\Chrome Dev\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Favicons*" -FolderName "Chrome_Dev_Favicons_XP_$UserName"
# Chrome Dev History XP
$UserPath = "$($_.FullName)\Local Settings\Application Data\Google\Chrome Dev\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "History*" -FolderName "Chrome_Dev_History_XP_$UserName"
# Chrome Dev Last Session XP
$UserPath = "$($_.FullName)\Local Settings\Application Data\Google\Chrome Dev\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Last Session" -FolderName "Chrome_Dev_Last_Session_XP_$UserName"
# Chrome Dev Last Tabs XP
$UserPath = "$($_.FullName)\Local Settings\Application Data\Google\Chrome Dev\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Last Tabs" -FolderName "Chrome_Dev_Last_Tabs_XP_$UserName"
# Chrome Dev Login Data XP
$UserPath = "$($_.FullName)\Local Settings\Application Data\Google\Chrome Dev\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Login Data" -FolderName "Chrome_Dev_Login_Data_XP_$UserName"
# Chrome Dev Preferences XP
$UserPath = "$($_.FullName)\Local Settings\Application Data\Google\Chrome Dev\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Preferences" -FolderName "Chrome_Dev_Preferences_XP_$UserName"
# Chrome Dev Shortcuts XP
$UserPath = "$($_.FullName)\Local Settings\Application Data\Google\Chrome Dev\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Shortcuts*" -FolderName "Chrome_Dev_Shortcuts_XP_$UserName"
# Chrome Dev Top Sites XP
$UserPath = "$($_.FullName)\Local Settings\Application Data\Google\Chrome Dev\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Top Sites*" -FolderName "Chrome_Dev_Top_Sites_XP_$UserName"
# Chrome Dev Visited Links XP
$UserPath = "$($_.FullName)\Local Settings\Application Data\Google\Chrome Dev\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Visited Links" -FolderName "Chrome_Dev_Visited_Links_XP_$UserName"
# Chrome Dev Web Data XP
$UserPath = "$($_.FullName)\Local Settings\Application Data\Google\Chrome Dev\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Web Data*" -FolderName "Chrome_Dev_Web_Data_XP_$UserName"
# Chrome Dev Bookmarks
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome Dev\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Bookmarks*" -FolderName "Chrome_Dev_Bookmarks_$UserName"
# Chrome Dev Cookies
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome Dev\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Cookies*" -FolderName "Chrome_Dev_Cookies_$UserName"
# Chrome Dev Current Session
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome Dev\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Current Session" -FolderName "Chrome_Dev_Current_Session_$UserName"
# Chrome Dev Current Tabs
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome Dev\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Current Tabs" -FolderName "Chrome_Dev_Current_Tabs_$UserName"
# Chrome Dev Download Metadata
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome Dev\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "DownloadMetadata" -FolderName "Chrome_Dev_Download_Metadata_$UserName"
# Chrome Dev Extension Cookies
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome Dev\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Extension Cookies*" -FolderName "Chrome_Dev_Extension_Cookies_$UserName"
# Chrome Dev Favicons
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome Dev\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Favicons*" -FolderName "Chrome_Dev_Favicons_$UserName"
# Chrome Dev History
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome Dev\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "History*" -FolderName "Chrome_Dev_History_$UserName"
# Chrome Dev Last Session
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome Dev\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Last Session" -FolderName "Chrome_Dev_Last_Session_$UserName"
# Chrome Dev Last Tabs
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome Dev\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Last Tabs" -FolderName "Chrome_Dev_Last_Tabs_$UserName"
# Chrome Dev Sessions Folder
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome Dev\User Data\*\Sessions"
Collect-Artifact -SourceDir $UserPath -FolderName "Chrome_Dev_Sessions_Folder_$UserName"
# Chrome Dev Login Data
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome Dev\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Login Data*" -FolderName "Chrome_Dev_Login_Data_$UserName"
# Chrome Dev Media History
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome Dev\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Media History*" -FolderName "Chrome_Dev_Media_History_$UserName"
# Chrome Dev Network Action Predictor
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome Dev\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Network Action Predictor*" -FolderName "Chrome_Dev_Network_Action_Predictor_$UserName"
# Chrome Dev Network Persistent State
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome Dev\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Network Persistent State" -FolderName "Chrome_Dev_Network_Persistent_State_$UserName"
# Chrome Dev Network Persistent State
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome Dev\User Data\*\Network"
Collect-Artifact -SourceDir $UserPath -FileMask "Network Persistent State" -FolderName "Chrome_Dev_Network_Persistent_State_$UserName"
# Chrome Dev Preferences
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome Dev\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Preferences" -FolderName "Chrome_Dev_Preferences_$UserName"
# Chrome Dev Quota Manager
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome Dev\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "QuotaManager*" -FolderName "Chrome_Dev_Quota_Manager_$UserName"
# Chrome Dev Quota Manager
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome Dev\User Data\*\WebStorage"
Collect-Artifact -SourceDir $UserPath -FileMask "QuotaManager*" -FolderName "Chrome_Dev_Quota_Manager_$UserName"
# Chrome Dev Reporting and NEL
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome Dev\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Reporting and NEL*" -FolderName "Chrome_Dev_Reporting_and_NEL_$UserName"
# Chrome Dev Reporting and NEL
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome Dev\User Data\*\Network"
Collect-Artifact -SourceDir $UserPath -FileMask "Reporting and NEL*" -FolderName "Chrome_Dev_Reporting_and_NEL_$UserName"
# Chrome Dev Shortcuts
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome Dev\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Shortcuts*" -FolderName "Chrome_Dev_Shortcuts_$UserName"
# Chrome Dev Top Sites
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome Dev\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Top Sites*" -FolderName "Chrome_Dev_Top_Sites_$UserName"
# Chrome Dev Trust Tokens
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome Dev\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Trust Tokens*" -FolderName "Chrome_Dev_Trust_Tokens_$UserName"
# Chrome Dev Trust Tokens
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome Dev\User Data\*\Network"
Collect-Artifact -SourceDir $UserPath -FileMask "Trust Tokens*" -FolderName "Chrome_Dev_Trust_Tokens_$UserName"
# Chrome Dev SyncData Database
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome Dev\User Data\*\Sync Data"
Collect-Artifact -SourceDir $UserPath -FileMask "SyncData.sqlite3" -FolderName "Chrome_Dev_SyncData_Database_$UserName"
# Chrome Dev Visited Links
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome Dev\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Visited Links" -FolderName "Chrome_Dev_Visited_Links_$UserName"
# Chrome Dev Web Data
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome Dev\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Web Data*" -FolderName "Chrome_Dev_Web_Data_$UserName"
# Chrome Dev IndexedDB
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome Dev\User Data\*\IndexedDB"
Collect-Artifact -SourceDir $UserPath -FolderName "Chrome_Dev_IndexedDB_$UserName"
# Chrome Dev Local Storage
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome Dev\User Data\*\Local Storage\leveldb"
Collect-Artifact -SourceDir $UserPath -FolderName "Chrome_Dev_Local_Storage_$UserName"
# Windows Protect Folder
$UserPath = "$($_.FullName)\AppData\Roaming\Microsoft\Protect\*"
Collect-Artifact -SourceDir $UserPath -FolderName "Windows_Protect_Folder_$UserName"
# Chrome Dev Snapshots Folder
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome Dev\User Data\Snapshots\*"
Collect-Artifact -SourceDir $UserPath -FolderName "Chrome_Dev_Snapshots_Folder_$UserName"
# Chrome SxS Bookmarks XP
$UserPath = "$($_.FullName)\Local Settings\Application Data\Google\Chrome SxS\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Bookmarks*" -FolderName "Chrome_SxS_Bookmarks_XP_$UserName"
# Chrome SxS Cookies XP
$UserPath = "$($_.FullName)\Local Settings\Application Data\Google\Chrome SxS\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Cookies*" -FolderName "Chrome_SxS_Cookies_XP_$UserName"
# Chrome SxS Current Session XP
$UserPath = "$($_.FullName)\Local Settings\Application Data\Google\Chrome SxS\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Current Session" -FolderName "Chrome_SxS_Current_Session_XP_$UserName"
# Chrome SxS Current Tabs XP
$UserPath = "$($_.FullName)\Local Settings\Application Data\Google\Chrome SxS\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Current Tabs" -FolderName "Chrome_SxS_Current_Tabs_XP_$UserName"
# Chrome SxS Favicons XP
$UserPath = "$($_.FullName)\Local Settings\Application Data\Google\Chrome SxS\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Favicons*" -FolderName "Chrome_SxS_Favicons_XP_$UserName"
# Chrome SxS History XP
$UserPath = "$($_.FullName)\Local Settings\Application Data\Google\Chrome SxS\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "History*" -FolderName "Chrome_SxS_History_XP_$UserName"
# Chrome SxS Last Session XP
$UserPath = "$($_.FullName)\Local Settings\Application Data\Google\Chrome SxS\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Last Session" -FolderName "Chrome_SxS_Last_Session_XP_$UserName"
# Chrome SxS Last Tabs XP
$UserPath = "$($_.FullName)\Local Settings\Application Data\Google\Chrome SxS\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Last Tabs" -FolderName "Chrome_SxS_Last_Tabs_XP_$UserName"
# Chrome SxS Login Data XP
$UserPath = "$($_.FullName)\Local Settings\Application Data\Google\Chrome SxS\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Login Data" -FolderName "Chrome_SxS_Login_Data_XP_$UserName"
# Chrome SxS Preferences XP
$UserPath = "$($_.FullName)\Local Settings\Application Data\Google\Chrome SxS\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Preferences" -FolderName "Chrome_SxS_Preferences_XP_$UserName"
# Chrome SxS Shortcuts XP
$UserPath = "$($_.FullName)\Local Settings\Application Data\Google\Chrome SxS\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Shortcuts*" -FolderName "Chrome_SxS_Shortcuts_XP_$UserName"
# Chrome SxS Top Sites XP
$UserPath = "$($_.FullName)\Local Settings\Application Data\Google\Chrome SxS\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Top Sites*" -FolderName "Chrome_SxS_Top_Sites_XP_$UserName"
# Chrome SxS Visited Links XP
$UserPath = "$($_.FullName)\Local Settings\Application Data\Google\Chrome SxS\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Visited Links" -FolderName "Chrome_SxS_Visited_Links_XP_$UserName"
# Chrome SxS Web Data XP
$UserPath = "$($_.FullName)\Local Settings\Application Data\Google\Chrome SxS\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Web Data*" -FolderName "Chrome_SxS_Web_Data_XP_$UserName"
# Chrome SxS Bookmarks
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome SxS\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Bookmarks*" -FolderName "Chrome_SxS_Bookmarks_$UserName"
# Chrome SxS Cookies
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome SxS\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Cookies*" -FolderName "Chrome_SxS_Cookies_$UserName"
# Chrome SxS Current Session
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome SxS\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Current Session" -FolderName "Chrome_SxS_Current_Session_$UserName"
# Chrome SxS Current Tabs
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome SxS\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Current Tabs" -FolderName "Chrome_SxS_Current_Tabs_$UserName"
# Chrome SxS Download Metadata
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome SxS\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "DownloadMetadata" -FolderName "Chrome_SxS_Download_Metadata_$UserName"
# Chrome SxS Extension Cookies
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome SxS\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Extension Cookies*" -FolderName "Chrome_SxS_Extension_Cookies_$UserName"
# Chrome SxS Favicons
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome SxS\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Favicons*" -FolderName "Chrome_SxS_Favicons_$UserName"
# Chrome SxS History
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome SxS\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "History*" -FolderName "Chrome_SxS_History_$UserName"
# Chrome SxS Last Session
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome SxS\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Last Session" -FolderName "Chrome_SxS_Last_Session_$UserName"
# Chrome SxS Last Tabs
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome SxS\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Last Tabs" -FolderName "Chrome_SxS_Last_Tabs_$UserName"
# Chrome SxS Sessions Folder
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome SxS\User Data\*\Sessions"
Collect-Artifact -SourceDir $UserPath -FolderName "Chrome_SxS_Sessions_Folder_$UserName"
# Chrome SxS Login Data
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome SxS\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Login Data*" -FolderName "Chrome_SxS_Login_Data_$UserName"
# Chrome SxS Media History
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome SxS\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Media History*" -FolderName "Chrome_SxS_Media_History_$UserName"
# Chrome SxS Network Action Predictor
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome SxS\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Network Action Predictor*" -FolderName "Chrome_SxS_Network_Action_Predictor_$UserName"
# Chrome SxS Network Persistent State
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome SxS\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Network Persistent State" -FolderName "Chrome_SxS_Network_Persistent_State_$UserName"
# Chrome SxS Network Persistent State
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome SxS\User Data\*\Network"
Collect-Artifact -SourceDir $UserPath -FileMask "Network Persistent State" -FolderName "Chrome_SxS_Network_Persistent_State_$UserName"
# Chrome SxS Preferences
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome SxS\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Preferences" -FolderName "Chrome_SxS_Preferences_$UserName"
# Chrome SxS Quota Manager
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome SxS\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "QuotaManager*" -FolderName "Chrome_SxS_Quota_Manager_$UserName"
# Chrome SxS Quota Manager
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome SxS\User Data\*\WebStorage"
Collect-Artifact -SourceDir $UserPath -FileMask "QuotaManager*" -FolderName "Chrome_SxS_Quota_Manager_$UserName"
# Chrome SxS Reporting and NEL
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome SxS\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Reporting and NEL*" -FolderName "Chrome_SxS_Reporting_and_NEL_$UserName"
# Chrome SxS Reporting and NEL
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome SxS\User Data\*\Network"
Collect-Artifact -SourceDir $UserPath -FileMask "Reporting and NEL*" -FolderName "Chrome_SxS_Reporting_and_NEL_$UserName"
# Chrome SxS Shortcuts
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome SxS\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Shortcuts*" -FolderName "Chrome_SxS_Shortcuts_$UserName"
# Chrome SxS Top Sites
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome SxS\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Top Sites*" -FolderName "Chrome_SxS_Top_Sites_$UserName"
# Chrome SxS Trust Tokens
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome SxS\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Trust Tokens*" -FolderName "Chrome_SxS_Trust_Tokens_$UserName"
# Chrome SxS Trust Tokens
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome SxS\User Data\*\Network"
Collect-Artifact -SourceDir $UserPath -FileMask "Trust Tokens*" -FolderName "Chrome_SxS_Trust_Tokens_$UserName"
# Chrome SxS SyncData Database
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome SxS\User Data\*\Sync Data"
Collect-Artifact -SourceDir $UserPath -FileMask "SyncData.sqlite3" -FolderName "Chrome_SxS_SyncData_Database_$UserName"
# Chrome SxS Visited Links
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome SxS\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Visited Links" -FolderName "Chrome_SxS_Visited_Links_$UserName"
# Chrome SxS Web Data
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome SxS\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Web Data*" -FolderName "Chrome_SxS_Web_Data_$UserName"
# Chrome SxS IndexedDB
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome SxS\User Data\*\IndexedDB"
Collect-Artifact -SourceDir $UserPath -FolderName "Chrome_SxS_IndexedDB_$UserName"
# Chrome SxS Local Storage
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome SxS\User Data\*\Local Storage\leveldb"
Collect-Artifact -SourceDir $UserPath -FolderName "Chrome_SxS_Local_Storage_$UserName"
# Windows Protect Folder
$UserPath = "$($_.FullName)\AppData\Roaming\Microsoft\Protect\*"
Collect-Artifact -SourceDir $UserPath -FolderName "Windows_Protect_Folder_$UserName"
# Chrome SxS Snapshots Folder
$UserPath = "$($_.FullName)\AppData\Local\Google\Chrome SxS\User Data\Snapshots\*"
Collect-Artifact -SourceDir $UserPath -FolderName "Chrome_SxS_Snapshots_Folder_$UserName"
# Chromium Bookmarks XP
$UserPath = "$($_.FullName)\Local Settings\Application Data\Chromium\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Bookmarks*" -FolderName "Chromium_Bookmarks_XP_$UserName"
# Chromium Cookies XP
$UserPath = "$($_.FullName)\Local Settings\Application Data\Chromium\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Cookies*" -FolderName "Chromium_Cookies_XP_$UserName"
# Chromium Current Session XP
$UserPath = "$($_.FullName)\Local Settings\Application Data\Chromium\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Current Session" -FolderName "Chromium_Current_Session_XP_$UserName"
# Chromium Current Tabs XP
$UserPath = "$($_.FullName)\Local Settings\Application Data\Chromium\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Current Tabs" -FolderName "Chromium_Current_Tabs_XP_$UserName"
# Chromium Favicons XP
$UserPath = "$($_.FullName)\Local Settings\Application Data\Chromium\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Favicons*" -FolderName "Chromium_Favicons_XP_$UserName"
# Chromium History XP
$UserPath = "$($_.FullName)\Local Settings\Application Data\Chromium\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "History*" -FolderName "Chromium_History_XP_$UserName"
# Chromium Last Session XP
$UserPath = "$($_.FullName)\Local Settings\Application Data\Chromium\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Last Session" -FolderName "Chromium_Last_Session_XP_$UserName"
# Chromium Last Tabs XP
$UserPath = "$($_.FullName)\Local Settings\Application Data\Chromium\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Last Tabs" -FolderName "Chromium_Last_Tabs_XP_$UserName"
# Chromium Login Data XP
$UserPath = "$($_.FullName)\Local Settings\Application Data\Chromium\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Login Data" -FolderName "Chromium_Login_Data_XP_$UserName"
# Chromium Preferences XP
$UserPath = "$($_.FullName)\Local Settings\Application Data\Chromium\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Preferences" -FolderName "Chromium_Preferences_XP_$UserName"
# Chromium Shortcuts XP
$UserPath = "$($_.FullName)\Local Settings\Application Data\Chromium\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Shortcuts*" -FolderName "Chromium_Shortcuts_XP_$UserName"
# Chromium Top Sites XP
$UserPath = "$($_.FullName)\Local Settings\Application Data\Chromium\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Top Sites*" -FolderName "Chromium_Top_Sites_XP_$UserName"
# Chromium Visited Links XP
$UserPath = "$($_.FullName)\Local Settings\Application Data\Chromium\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Visited Links" -FolderName "Chromium_Visited_Links_XP_$UserName"
# Chromium Web Data XP
$UserPath = "$($_.FullName)\Local Settings\Application Data\Chromium\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Web Data*" -FolderName "Chromium_Web_Data_XP_$UserName"
# Chromium Bookmarks
$UserPath = "$($_.FullName)\AppData\Local\Chromium\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Bookmarks*" -FolderName "Chromium_Bookmarks_$UserName"
# Chromium Cookies
$UserPath = "$($_.FullName)\AppData\Local\Chromium\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Cookies*" -FolderName "Chromium_Cookies_$UserName"
# Chromium Current Session
$UserPath = "$($_.FullName)\AppData\Local\Chromium\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Current Session" -FolderName "Chromium_Current_Session_$UserName"
# Chromium Current Tabs
$UserPath = "$($_.FullName)\AppData\Local\Chromium\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Current Tabs" -FolderName "Chromium_Current_Tabs_$UserName"
# Chromium Download Metadata
$UserPath = "$($_.FullName)\AppData\Local\Chromium\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "DownloadMetadata" -FolderName "Chromium_Download_Metadata_$UserName"
# Chromium Extension Cookies
$UserPath = "$($_.FullName)\AppData\Local\Chromium\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Extension Cookies*" -FolderName "Chromium_Extension_Cookies_$UserName"
# Chromium Favicons
$UserPath = "$($_.FullName)\AppData\Local\Chromium\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Favicons*" -FolderName "Chromium_Favicons_$UserName"
# Chromium History
$UserPath = "$($_.FullName)\AppData\Local\Chromium\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "History*" -FolderName "Chromium_History_$UserName"
# Chromium Last Session
$UserPath = "$($_.FullName)\AppData\Local\Chromium\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Last Session" -FolderName "Chromium_Last_Session_$UserName"
# Chromium Last Tabs
$UserPath = "$($_.FullName)\AppData\Local\Chromium\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Last Tabs" -FolderName "Chromium_Last_Tabs_$UserName"
# Chromium Sessions Folder
$UserPath = "$($_.FullName)\AppData\Local\Chromium\User Data\*\Sessions"
Collect-Artifact -SourceDir $UserPath -FolderName "Chromium_Sessions_Folder_$UserName"
# Chromium Login Data
$UserPath = "$($_.FullName)\AppData\Local\Chromium\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Login Data*" -FolderName "Chromium_Login_Data_$UserName"
# Chromium Media History
$UserPath = "$($_.FullName)\AppData\Local\Chromium\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Media History*" -FolderName "Chromium_Media_History_$UserName"
# Chromium Network Action Predictor
$UserPath = "$($_.FullName)\AppData\Local\Chromium\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Network Action Predictor*" -FolderName "Chromium_Network_Action_Predictor_$UserName"
# Chromium Network Persistent State
$UserPath = "$($_.FullName)\AppData\Local\Chromium\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Network Persistent State" -FolderName "Chromium_Network_Persistent_State_$UserName"
# Chromium Network Persistent State
$UserPath = "$($_.FullName)\AppData\Local\Chromium\User Data\*\Network"
Collect-Artifact -SourceDir $UserPath -FileMask "Network Persistent State" -FolderName "Chromium_Network_Persistent_State_$UserName"
# Chromium Preferences
$UserPath = "$($_.FullName)\AppData\Local\Chromium\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Preferences" -FolderName "Chromium_Preferences_$UserName"
# Chromium Secure Preferences
$UserPath = "$($_.FullName)\AppData\Local\Chromium\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Secure Preferences" -FolderName "Chromium_Secure_Preferences_$UserName"
# Chromium Quota Manager
$UserPath = "$($_.FullName)\AppData\Local\Chromium\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "QuotaManager*" -FolderName "Chromium_Quota_Manager_$UserName"
# Chromium Quota Manager
$UserPath = "$($_.FullName)\AppData\Local\Chromium\User Data\*\WebStorage"
Collect-Artifact -SourceDir $UserPath -FileMask "QuotaManager*" -FolderName "Chromium_Quota_Manager_$UserName"
# Chromium Reporting and NEL
$UserPath = "$($_.FullName)\AppData\Local\Chromium\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Reporting and NEL*" -FolderName "Chromium_Reporting_and_NEL_$UserName"
# Chromium Reporting and NEL
$UserPath = "$($_.FullName)\AppData\Local\Chromium\User Data\*\Network"
Collect-Artifact -SourceDir $UserPath -FileMask "Reporting and NEL*" -FolderName "Chromium_Reporting_and_NEL_$UserName"
# Chromium Shortcuts
$UserPath = "$($_.FullName)\AppData\Local\Chromium\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Shortcuts*" -FolderName "Chromium_Shortcuts_$UserName"
# Chromium Top Sites
$UserPath = "$($_.FullName)\AppData\Local\Chromium\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Top Sites*" -FolderName "Chromium_Top_Sites_$UserName"
# Chromium Trust Tokens
$UserPath = "$($_.FullName)\AppData\Local\Chromium\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Trust Tokens*" -FolderName "Chromium_Trust_Tokens_$UserName"
# Chromium Trust Tokens
$UserPath = "$($_.FullName)\AppData\Local\Chromium\User Data\*\Network"
Collect-Artifact -SourceDir $UserPath -FileMask "Trust Tokens*" -FolderName "Chromium_Trust_Tokens_$UserName"
# Chromium SyncData Database
$UserPath = "$($_.FullName)\AppData\Local\Chromium\User Data\*\Sync Data"
Collect-Artifact -SourceDir $UserPath -FileMask "SyncData.sqlite3" -FolderName "Chromium_SyncData_Database_$UserName"
# Chromium Visited Links
$UserPath = "$($_.FullName)\AppData\Local\Chromium\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Visited Links" -FolderName "Chromium_Visited_Links_$UserName"
# Chromium Web Data
$UserPath = "$($_.FullName)\AppData\Local\Chromium\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Web Data*" -FolderName "Chromium_Web_Data_$UserName"
# Chromium IndexedDB
$UserPath = "$($_.FullName)\AppData\Local\Chromium\User Data\*\IndexedDB"
Collect-Artifact -SourceDir $UserPath -FolderName "Chromium_IndexedDB_$UserName"
# Chromium Local Storage
$UserPath = "$($_.FullName)\AppData\Local\Chromium\User Data\*\Local Storage\leveldb"
Collect-Artifact -SourceDir $UserPath -FolderName "Chromium_Local_Storage_$UserName"
# Windows Protect Folder
$UserPath = "$($_.FullName)\AppData\Roaming\Microsoft\Protect\*"
Collect-Artifact -SourceDir $UserPath -FolderName "Windows_Protect_Folder_$UserName"
# Chromium Snapshots Folder
$UserPath = "$($_.FullName)\AppData\Local\Chromium\User Data\Snapshots\*"
Collect-Artifact -SourceDir $UserPath -FolderName "Chromium_Snapshots_Folder_$UserName"
# CocCoc Bookmarks
$UserPath = "$($_.FullName)\AppData\Local\CocCoc\Browser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Bookmarks*" -FolderName "CocCoc_Bookmarks_$UserName"
# CocCoc Cookies
$UserPath = "$($_.FullName)\AppData\Local\CocCoc\Browser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Cookies*" -FolderName "CocCoc_Cookies_$UserName"
# CocCoc Current Session
$UserPath = "$($_.FullName)\AppData\Local\CocCoc\Browser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Current Session" -FolderName "CocCoc_Current_Session_$UserName"
# CocCoc Current Tabs
$UserPath = "$($_.FullName)\AppData\Local\CocCoc\Browser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Current Tabs" -FolderName "CocCoc_Current_Tabs_$UserName"
# CocCoc Download Metadata
$UserPath = "$($_.FullName)\AppData\Local\CocCoc\Browser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "DownloadMetadata" -FolderName "CocCoc_Download_Metadata_$UserName"
# CocCoc Extension Cookies
$UserPath = "$($_.FullName)\AppData\Local\CocCoc\Browser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Extension Cookies" -FolderName "CocCoc_Extension_Cookies_$UserName"
# CocCoc Favicons
$UserPath = "$($_.FullName)\AppData\Local\CocCoc\Browser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Favicons*" -FolderName "CocCoc_Favicons_$UserName"
# CocCoc History
$UserPath = "$($_.FullName)\AppData\Local\CocCoc\Browser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "History*" -FolderName "CocCoc_History_$UserName"
# CocCoc Last Session
$UserPath = "$($_.FullName)\AppData\Local\CocCoc\Browser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Last Session" -FolderName "CocCoc_Last_Session_$UserName"
# CocCoc Last Tabs
$UserPath = "$($_.FullName)\AppData\Local\CocCoc\Browser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Last Tabs" -FolderName "CocCoc_Last_Tabs_$UserName"
# CocCoc Sessions Folder
$UserPath = "$($_.FullName)\AppData\Local\CocCoc\Browser\User Data\*\Sessions"
Collect-Artifact -SourceDir $UserPath -FolderName "CocCoc_Sessions_Folder_$UserName"
# CocCoc Login Data
$UserPath = "$($_.FullName)\AppData\Local\CocCoc\Browser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Login Data*" -FolderName "CocCoc_Login_Data_$UserName"
# CocCoc Media History
$UserPath = "$($_.FullName)\AppData\Local\CocCoc\Browser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Media History*" -FolderName "CocCoc_Media_History_$UserName"
# CocCoc Network Action Predictor
$UserPath = "$($_.FullName)\AppData\Local\CocCoc\Browser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Network Action Predictor" -FolderName "CocCoc_Network_Action_Predictor_$UserName"
# CocCoc Network Persistent State
$UserPath = "$($_.FullName)\AppData\Local\CocCoc\Browser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Network Persistent State" -FolderName "CocCoc_Network_Persistent_State_$UserName"
# CocCoc Preferences
$UserPath = "$($_.FullName)\AppData\Local\CocCoc\Browser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Preferences" -FolderName "CocCoc_Preferences_$UserName"
# CocCoc Quota Manager
$UserPath = "$($_.FullName)\AppData\Local\CocCoc\Browser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "QuotaManager" -FolderName "CocCoc_Quota_Manager_$UserName"
# CocCoc Reporting and NEL
$UserPath = "$($_.FullName)\AppData\Local\CocCoc\Browser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Reporting and NEL" -FolderName "CocCoc_Reporting_and_NEL_$UserName"
# CocCoc Shortcuts
$UserPath = "$($_.FullName)\AppData\Local\CocCoc\Browser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Shortcuts*" -FolderName "CocCoc_Shortcuts_$UserName"
# CocCoc Top Sites
$UserPath = "$($_.FullName)\AppData\Local\CocCoc\Browser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Top Sites*" -FolderName "CocCoc_Top_Sites_$UserName"
# CocCoc Trust Tokens
$UserPath = "$($_.FullName)\AppData\Local\CocCoc\Browser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Trust Tokens*" -FolderName "CocCoc_Trust_Tokens_$UserName"
# CocCoc SyncData Database
$UserPath = "$($_.FullName)\AppData\Local\CocCoc\Browser\User Data\*\Sync Data"
Collect-Artifact -SourceDir $UserPath -FolderName "CocCoc_SyncData_Database_$UserName"
# CocCoc Visited Links
$UserPath = "$($_.FullName)\AppData\Local\CocCoc\Browser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Visited Links" -FolderName "CocCoc_Visited_Links_$UserName"
# CocCoc Web Data
$UserPath = "$($_.FullName)\AppData\Local\CocCoc\Browser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Web Data*" -FolderName "CocCoc_Web_Data_$UserName"
# Windows Protect Folder
$UserPath = "$($_.FullName)\AppData\Roaming\Microsoft\Protect\*"
Collect-Artifact -SourceDir $UserPath -FolderName "Windows_Protect_Folder_$UserName"
# CocCoc Snapshots Folder
$UserPath = "$($_.FullName)\AppData\Local\CocCoc\Browser\User Data\Snapshots\*"
Collect-Artifact -SourceDir $UserPath -FolderName "CocCoc_Snapshots_Folder_$UserName"
# Edge folder
$UserPath = "$($_.FullName)\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe"
Collect-Artifact -SourceDir $UserPath -FolderName "Edge_folder_$UserName"
# Edge Beta Collections
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge Beta\User Data\*\Collections"
Collect-Artifact -SourceDir $UserPath -FileMask "collectionsSQLite*" -FolderName "Edge_Beta_Collections_$UserName"
# Edge Beta Bookmarks
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge Beta\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Bookmarks*" -FolderName "Edge_Beta_Bookmarks_$UserName"
# Edge Beta Cookies
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge Beta\User Data\*\Network"
Collect-Artifact -SourceDir $UserPath -FileMask "Cookies*" -FolderName "Edge_Beta_Cookies_$UserName"
# Edge Beta Current Session
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge Beta\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Current Session" -FolderName "Edge_Beta_Current_Session_$UserName"
# Edge Beta Current Tabs
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge Beta\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Current Tabs" -FolderName "Edge_Beta_Current_Tabs_$UserName"
# Edge Beta Extension Cookies
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge Beta\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Extension Cookies*" -FolderName "Edge_Beta_Extension_Cookies_$UserName"
# Edge Beta Favicons
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge Beta\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Favicons*" -FolderName "Edge_Beta_Favicons_$UserName"
# Edge Beta History
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge Beta\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "History*" -FolderName "Edge_Beta_History_$UserName"
# Edge Beta Last Session
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge Beta\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Last Session" -FolderName "Edge_Beta_Last_Session_$UserName"
# Edge Beta Last Tabs
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge Beta\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Last Tabs" -FolderName "Edge_Beta_Last_Tabs_$UserName"
# Edge Beta Sessions Folder
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge Beta\User Data\*\Sessions"
Collect-Artifact -SourceDir $UserPath -FolderName "Edge_Beta_Sessions_Folder_$UserName"
# Edge Beta Login Data
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge Beta\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Login Data*" -FolderName "Edge_Beta_Login_Data_$UserName"
# Edge Beta Media History
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge Beta\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Media History*" -FolderName "Edge_Beta_Media_History_$UserName"
# Edge Beta Network Action Predictor
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge Beta\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Network Action Predictor*" -FolderName "Edge_Beta_Network_Action_Predictor_$UserName"
# Edge Beta Network Persistent State
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge Beta\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Network Persistent State" -FolderName "Edge_Beta_Network_Persistent_State_$UserName"
# Edge Beta Network Persistent State
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge Beta\User Data\*\Network"
Collect-Artifact -SourceDir $UserPath -FileMask "Network Persistent State" -FolderName "Edge_Beta_Network_Persistent_State_$UserName"
# Edge Beta Preferences
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge Beta\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Preferences" -FolderName "Edge_Beta_Preferences_$UserName"
# Edge Beta Quota Manager
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge Beta\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "QuotaManager*" -FolderName "Edge_Beta_Quota_Manager_$UserName"
# Edge Beta Quota Manager
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge Beta\User Data\*\WebStorage"
Collect-Artifact -SourceDir $UserPath -FileMask "QuotaManager*" -FolderName "Edge_Beta_Quota_Manager_$UserName"
# Edge Beta Reporting and NEL
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge Beta\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Reporting and NEL*" -FolderName "Edge_Beta_Reporting_and_NEL_$UserName"
# Edge Beta Reporting and NEL
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge Beta\User Data\*\Network"
Collect-Artifact -SourceDir $UserPath -FileMask "Reporting and NEL*" -FolderName "Edge_Beta_Reporting_and_NEL_$UserName"
# Edge Beta Shortcuts
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge Beta\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Shortcuts*" -FolderName "Edge_Beta_Shortcuts_$UserName"
# Edge Beta Top Sites
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge Beta\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Top Sites*" -FolderName "Edge_Beta_Top_Sites_$UserName"
# Edge Beta Trust Tokens
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge Beta\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Trust Tokens*" -FolderName "Edge_Beta_Trust_Tokens_$UserName"
# Edge Beta Trust Tokens
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge Beta\User Data\*\Network"
Collect-Artifact -SourceDir $UserPath -FileMask "Trust Tokens*" -FolderName "Edge_Beta_Trust_Tokens_$UserName"
# Edge Beta SyncData Database
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge Beta\User Data\*\Sync Data"
Collect-Artifact -SourceDir $UserPath -FileMask "SyncData.sqlite3" -FolderName "Edge_Beta_SyncData_Database_$UserName"
# Edge Beta Visited Links
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge Beta\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Visited Links" -FolderName "Edge_Beta_Visited_Links_$UserName"
# Edge Beta Web Data
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge Beta\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Web Data*" -FolderName "Edge_Beta_Web_Data_$UserName"
# Edge Beta IndexedDB
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge Beta\User Data\*\IndexedDB"
Collect-Artifact -SourceDir $UserPath -FolderName "Edge_Beta_IndexedDB_$UserName"
# Edge Beta Local Storage
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge Beta\User Data\*\Local Storage\leveldb"
Collect-Artifact -SourceDir $UserPath -FolderName "Edge_Beta_Local_Storage_$UserName"
# Edge Beta WebAssistDatabase
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge Beta\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "WebAssistDatabase*" -FolderName "Edge_Beta_WebAssistDatabase_$UserName"
# Windows Protect Folder
$UserPath = "$($_.FullName)\AppData\Roaming\Microsoft\Protect\*"
Collect-Artifact -SourceDir $UserPath -FolderName "Windows_Protect_Folder_$UserName"
# Edge Beta Snapshots Folder
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge Beta\User Data\Snapshots\*"
Collect-Artifact -SourceDir $UserPath -FolderName "Edge_Beta_Snapshots_Folder_$UserName"
# Edge Collections
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge\User Data\*\Collections"
Collect-Artifact -SourceDir $UserPath -FileMask "collectionsSQLite*" -FolderName "Edge_Collections_$UserName"
# Edge Bookmarks
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Bookmarks*" -FolderName "Edge_Bookmarks_$UserName"
# Edge Cookies
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge\User Data\*\Network"
Collect-Artifact -SourceDir $UserPath -FileMask "Cookies*" -FolderName "Edge_Cookies_$UserName"
# Edge Current Session
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Current Session" -FolderName "Edge_Current_Session_$UserName"
# Edge Current Tabs
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Current Tabs" -FolderName "Edge_Current_Tabs_$UserName"
# Edge Extension Cookies
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Extension Cookies*" -FolderName "Edge_Extension_Cookies_$UserName"
# Edge Favicons
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Favicons*" -FolderName "Edge_Favicons_$UserName"
# Edge History
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "History*" -FolderName "Edge_History_$UserName"
# Edge Last Session
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Last Session" -FolderName "Edge_Last_Session_$UserName"
# Edge Last Tabs
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Last Tabs" -FolderName "Edge_Last_Tabs_$UserName"
# Edge Sessions Folder
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge\User Data\*\Sessions"
Collect-Artifact -SourceDir $UserPath -FolderName "Edge_Sessions_Folder_$UserName"
# Edge Login Data
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Login Data*" -FolderName "Edge_Login_Data_$UserName"
# Edge Media History
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Media History*" -FolderName "Edge_Media_History_$UserName"
# Edge Network Action Predictor
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Network Action Predictor*" -FolderName "Edge_Network_Action_Predictor_$UserName"
# Edge Network Persistent State
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Network Persistent State" -FolderName "Edge_Network_Persistent_State_$UserName"
# Edge Network Persistent State
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge\User Data\*\Network"
Collect-Artifact -SourceDir $UserPath -FileMask "Network Persistent State" -FolderName "Edge_Network_Persistent_State_$UserName"
# Edge Preferences
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Preferences" -FolderName "Edge_Preferences_$UserName"
# Edge Secure Preferences
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Secure Preferences" -FolderName "Edge_Secure_Preferences_$UserName"
# Edge Quota Manager
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "QuotaManager*" -FolderName "Edge_Quota_Manager_$UserName"
# Edge Quota Manager
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge\User Data\*\WebStorage"
Collect-Artifact -SourceDir $UserPath -FileMask "QuotaManager*" -FolderName "Edge_Quota_Manager_$UserName"
# Edge Reporting and NEL
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Reporting and NEL*" -FolderName "Edge_Reporting_and_NEL_$UserName"
# Edge Reporting and NEL
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge\User Data\*\Network"
Collect-Artifact -SourceDir $UserPath -FileMask "Reporting and NEL*" -FolderName "Edge_Reporting_and_NEL_$UserName"
# Edge Shortcuts
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Shortcuts*" -FolderName "Edge_Shortcuts_$UserName"
# Edge Top Sites
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Top Sites*" -FolderName "Edge_Top_Sites_$UserName"
# Edge Trust Tokens
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Trust Tokens*" -FolderName "Edge_Trust_Tokens_$UserName"
# Edge Trust Tokens
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge\User Data\*\Network"
Collect-Artifact -SourceDir $UserPath -FileMask "Trust Tokens*" -FolderName "Edge_Trust_Tokens_$UserName"
# Edge SyncData Database
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge\User Data\*\Sync Data"
Collect-Artifact -SourceDir $UserPath -FileMask "SyncData.sqlite3" -FolderName "Edge_SyncData_Database_$UserName"
# Edge Visited Links
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Visited Links" -FolderName "Edge_Visited_Links_$UserName"
# Edge Web Data
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Web Data*" -FolderName "Edge_Web_Data_$UserName"
# Edge IndexedDB
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge\User Data\*\IndexedDB"
Collect-Artifact -SourceDir $UserPath -FolderName "Edge_IndexedDB_$UserName"
# Edge Local Storage
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge\User Data\*\Local Storage\leveldb"
Collect-Artifact -SourceDir $UserPath -FolderName "Edge_Local_Storage_$UserName"
# Edge WebAssistDatabase
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "WebAssistDatabase*" -FolderName "Edge_WebAssistDatabase_$UserName"
# Windows Protect Folder
$UserPath = "$($_.FullName)\AppData\Roaming\Microsoft\Protect\*"
Collect-Artifact -SourceDir $UserPath -FolderName "Windows_Protect_Folder_$UserName"
# Edge Snapshots Folder
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge\User Data\Snapshots\*"
Collect-Artifact -SourceDir $UserPath -FolderName "Edge_Snapshots_Folder_$UserName"
# Edge Dev Collections
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge Dev\User Data\*\Collections"
Collect-Artifact -SourceDir $UserPath -FileMask "collectionsSQLite*" -FolderName "Edge_Dev_Collections_$UserName"
# Edge Dev Bookmarks
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge Dev\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Bookmarks*" -FolderName "Edge_Dev_Bookmarks_$UserName"
# Edge Dev Cookies
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge Dev\User Data\*\Network"
Collect-Artifact -SourceDir $UserPath -FileMask "Cookies*" -FolderName "Edge_Dev_Cookies_$UserName"
# Edge Dev Current Session
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge Dev\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Current Session" -FolderName "Edge_Dev_Current_Session_$UserName"
# Edge Dev Current Tabs
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge Dev\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Current Tabs" -FolderName "Edge_Dev_Current_Tabs_$UserName"
# Edge Dev Extension Cookies
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge Dev\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Extension Cookies*" -FolderName "Edge_Dev_Extension_Cookies_$UserName"
# Edge Dev Favicons
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge Dev\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Favicons*" -FolderName "Edge_Dev_Favicons_$UserName"
# Edge Dev History
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge Dev\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "History*" -FolderName "Edge_Dev_History_$UserName"
# Edge Dev Last Session
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge Dev\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Last Session" -FolderName "Edge_Dev_Last_Session_$UserName"
# Edge Dev Last Tabs
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge Dev\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Last Tabs" -FolderName "Edge_Dev_Last_Tabs_$UserName"
# Edge Dev Sessions Folder
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge Dev\User Data\*\Sessions"
Collect-Artifact -SourceDir $UserPath -FolderName "Edge_Dev_Sessions_Folder_$UserName"
# Edge Dev Login Data
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge Dev\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Login Data*" -FolderName "Edge_Dev_Login_Data_$UserName"
# Edge Dev Media History
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge Dev\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Media History*" -FolderName "Edge_Dev_Media_History_$UserName"
# Edge Dev Network Action Predictor
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge Dev\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Network Action Predictor*" -FolderName "Edge_Dev_Network_Action_Predictor_$UserName"
# Edge Dev Network Persistent State
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge Dev\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Network Persistent State" -FolderName "Edge_Dev_Network_Persistent_State_$UserName"
# Edge Dev Network Persistent State
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge Dev\User Data\*\Network"
Collect-Artifact -SourceDir $UserPath -FileMask "Network Persistent State" -FolderName "Edge_Dev_Network_Persistent_State_$UserName"
# Edge Dev Preferences
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge Dev\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Preferences" -FolderName "Edge_Dev_Preferences_$UserName"
# Edge Dev Quota Manager
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge Dev\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "QuotaManager*" -FolderName "Edge_Dev_Quota_Manager_$UserName"
# Edge Dev Quota Manager
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge Dev\User Data\*\WebStorage"
Collect-Artifact -SourceDir $UserPath -FileMask "QuotaManager*" -FolderName "Edge_Dev_Quota_Manager_$UserName"
# Edge Dev Reporting and NEL
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge Dev\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Reporting and NEL*" -FolderName "Edge_Dev_Reporting_and_NEL_$UserName"
# Edge Dev Reporting and NEL
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge Dev\User Data\*\Network"
Collect-Artifact -SourceDir $UserPath -FileMask "Reporting and NEL*" -FolderName "Edge_Dev_Reporting_and_NEL_$UserName"
# Edge Dev Shortcuts
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge Dev\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Shortcuts*" -FolderName "Edge_Dev_Shortcuts_$UserName"
# Edge Dev Top Sites
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge Dev\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Top Sites*" -FolderName "Edge_Dev_Top_Sites_$UserName"
# Edge Dev Trust Tokens
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge Dev\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Trust Tokens*" -FolderName "Edge_Dev_Trust_Tokens_$UserName"
# Edge Dev Trust Tokens
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge Dev\User Data\*\Network"
Collect-Artifact -SourceDir $UserPath -FileMask "Trust Tokens*" -FolderName "Edge_Dev_Trust_Tokens_$UserName"
# Edge Dev SyncData Database
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge Dev\User Data\*\Sync Data"
Collect-Artifact -SourceDir $UserPath -FileMask "SyncData.sqlite3" -FolderName "Edge_Dev_SyncData_Database_$UserName"
# Edge Dev Visited Links
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge Dev\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Visited Links" -FolderName "Edge_Dev_Visited_Links_$UserName"
# Edge Dev Web Data
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge Dev\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Web Data*" -FolderName "Edge_Dev_Web_Data_$UserName"
# Edge Dev IndexedDB
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge Dev\User Data\*\IndexedDB"
Collect-Artifact -SourceDir $UserPath -FolderName "Edge_Dev_IndexedDB_$UserName"
# Edge Dev Local Storage
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge Dev\User Data\*\Local Storage\leveldb"
Collect-Artifact -SourceDir $UserPath -FolderName "Edge_Dev_Local_Storage_$UserName"
# Edge Dev WebAssistDatabase
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge Dev\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "WebAssistDatabase*" -FolderName "Edge_Dev_WebAssistDatabase_$UserName"
# Windows Protect Folder
$UserPath = "$($_.FullName)\AppData\Roaming\Microsoft\Protect\*"
Collect-Artifact -SourceDir $UserPath -FolderName "Windows_Protect_Folder_$UserName"
# Edge Dev Snapshots Folder
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge Dev\User Data\Snapshots\*"
Collect-Artifact -SourceDir $UserPath -FolderName "Edge_Dev_Snapshots_Folder_$UserName"
# Edge SxS Collections
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge SxS\User Data\*\Collections"
Collect-Artifact -SourceDir $UserPath -FileMask "collectionsSQLite*" -FolderName "Edge_SxS_Collections_$UserName"
# Edge SxS Bookmarks
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge SxS\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Bookmarks*" -FolderName "Edge_SxS_Bookmarks_$UserName"
# Edge SxS Cookies
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge SxS\User Data\*\Network"
Collect-Artifact -SourceDir $UserPath -FileMask "Cookies*" -FolderName "Edge_SxS_Cookies_$UserName"
# Edge SxS Current Session
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge SxS\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Current Session" -FolderName "Edge_SxS_Current_Session_$UserName"
# Edge SxS Current Tabs
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge SxS\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Current Tabs" -FolderName "Edge_SxS_Current_Tabs_$UserName"
# Edge SxS Extension Cookies
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge SxS\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Extension Cookies*" -FolderName "Edge_SxS_Extension_Cookies_$UserName"
# Edge SxS Favicons
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge SxS\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Favicons*" -FolderName "Edge_SxS_Favicons_$UserName"
# Edge SxS History
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge SxS\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "History*" -FolderName "Edge_SxS_History_$UserName"
# Edge SxS Last Session
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge SxS\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Last Session" -FolderName "Edge_SxS_Last_Session_$UserName"
# Edge SxS Last Tabs
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge SxS\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Last Tabs" -FolderName "Edge_SxS_Last_Tabs_$UserName"
# Edge SxS Sessions Folder
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge SxS\User Data\*\Sessions"
Collect-Artifact -SourceDir $UserPath -FolderName "Edge_SxS_Sessions_Folder_$UserName"
# Edge SxS Login Data
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge SxS\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Login Data*" -FolderName "Edge_SxS_Login_Data_$UserName"
# Edge SxS Media History
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge SxS\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Media History*" -FolderName "Edge_SxS_Media_History_$UserName"
# Edge SxS Network Action Predictor
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge SxS\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Network Action Predictor*" -FolderName "Edge_SxS_Network_Action_Predictor_$UserName"
# Edge SxS Network Persistent State
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge SxS\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Network Persistent State" -FolderName "Edge_SxS_Network_Persistent_State_$UserName"
# Edge SxS Network Persistent State
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge SxS\User Data\*\Network"
Collect-Artifact -SourceDir $UserPath -FileMask "Network Persistent State" -FolderName "Edge_SxS_Network_Persistent_State_$UserName"
# Edge SxS Preferences
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge SxS\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Preferences" -FolderName "Edge_SxS_Preferences_$UserName"
# Edge SxS Quota Manager
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge SxS\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "QuotaManager*" -FolderName "Edge_SxS_Quota_Manager_$UserName"
# Edge SxS Quota Manager
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge SxS\User Data\*\WebStorage"
Collect-Artifact -SourceDir $UserPath -FileMask "QuotaManager*" -FolderName "Edge_SxS_Quota_Manager_$UserName"
# Edge SxS Reporting and NEL
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge SxS\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Reporting and NEL*" -FolderName "Edge_SxS_Reporting_and_NEL_$UserName"
# Edge SxS Reporting and NEL
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge SxS\User Data\*\Network"
Collect-Artifact -SourceDir $UserPath -FileMask "Reporting and NEL*" -FolderName "Edge_SxS_Reporting_and_NEL_$UserName"
# Edge SxS Shortcuts
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge SxS\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Shortcuts*" -FolderName "Edge_SxS_Shortcuts_$UserName"
# Edge SxS Top Sites
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge SxS\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Top Sites*" -FolderName "Edge_SxS_Top_Sites_$UserName"
# Edge SxS Trust Tokens
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge SxS\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Trust Tokens*" -FolderName "Edge_SxS_Trust_Tokens_$UserName"
# Edge SxS Trust Tokens
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge SxS\User Data\*\Network"
Collect-Artifact -SourceDir $UserPath -FileMask "Trust Tokens*" -FolderName "Edge_SxS_Trust_Tokens_$UserName"
# Edge SxS SyncData Database
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge SxS\User Data\*\Sync Data"
Collect-Artifact -SourceDir $UserPath -FileMask "SyncData.sqlite3" -FolderName "Edge_SxS_SyncData_Database_$UserName"
# Edge SxS Visited Links
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge SxS\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Visited Links" -FolderName "Edge_SxS_Visited_Links_$UserName"
# Edge SxS Web Data
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge SxS\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Web Data*" -FolderName "Edge_SxS_Web_Data_$UserName"
# Edge SxS IndexedDB
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge SxS\User Data\*\IndexedDB"
Collect-Artifact -SourceDir $UserPath -FolderName "Edge_SxS_IndexedDB_$UserName"
# Edge SxS Local Storage
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge SxS\User Data\*\Local Storage\leveldb"
Collect-Artifact -SourceDir $UserPath -FolderName "Edge_SxS_Local_Storage_$UserName"
# Edge SxS WebAssistDatabase
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge SxS\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "WebAssistDatabase*" -FolderName "Edge_SxS_WebAssistDatabase_$UserName"
# Windows Protect Folder
$UserPath = "$($_.FullName)\AppData\Roaming\Microsoft\Protect\*"
Collect-Artifact -SourceDir $UserPath -FolderName "Windows_Protect_Folder_$UserName"
# Edge SxS Snapshots Folder
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Edge SxS\User Data\Snapshots\*"
Collect-Artifact -SourceDir $UserPath -FolderName "Edge_SxS_Snapshots_Folder_$UserName"
# Addons
$UserPath = "$($_.FullName)\AppData\Roaming\Mozilla\Firefox\Profiles\*"
Collect-Artifact -SourceDir $UserPath -FileMask "addons.sqlite*" -FolderName "Addons_$UserName"
# Bookmarks
$UserPath = "$($_.FullName)\AppData\Roaming\Mozilla\Firefox\Profiles\*\weave"
Collect-Artifact -SourceDir $UserPath -FileMask "bookmarks.sqlite*" -FolderName "Bookmarks_$UserName"
# Bookmarks
$UserPath = "$($_.FullName)\AppData\Roaming\Mozilla\Firefox\Profiles\*\bookmarkbackups"
Collect-Artifact -SourceDir $UserPath -FolderName "Bookmarks_$UserName"
# Cookies
$UserPath = "$($_.FullName)\AppData\Roaming\Mozilla\Firefox\Profiles\*"
Collect-Artifact -SourceDir $UserPath -FileMask "cookies.sqlite*" -FolderName "Cookies_$UserName"
# Cookies
$UserPath = "$($_.FullName)\AppData\Roaming\Mozilla\Firefox\Profiles\*"
Collect-Artifact -SourceDir $UserPath -FileMask "firefox_cookies.sqlite*" -FolderName "Cookies_$UserName"
# Downloads
$UserPath = "$($_.FullName)\AppData\Roaming\Mozilla\Firefox\Profiles\*"
Collect-Artifact -SourceDir $UserPath -FileMask "downloads.sqlite*" -FolderName "Downloads_$UserName"
# Extensions
$UserPath = "$($_.FullName)\AppData\Roaming\Mozilla\Firefox\Profiles\*"
Collect-Artifact -SourceDir $UserPath -FileMask "extensions.json" -FolderName "Extensions_$UserName"
# Favicons
$UserPath = "$($_.FullName)\AppData\Roaming\Mozilla\Firefox\Profiles\*"
Collect-Artifact -SourceDir $UserPath -FileMask "favicons.sqlite*" -FolderName "Favicons_$UserName"
# Form history
$UserPath = "$($_.FullName)\AppData\Roaming\Mozilla\Firefox\Profiles\*"
Collect-Artifact -SourceDir $UserPath -FileMask "formhistory.sqlite*" -FolderName "Form_history_$UserName"
# Permissions
$UserPath = "$($_.FullName)\AppData\Roaming\Mozilla\Firefox\Profiles\*"
Collect-Artifact -SourceDir $UserPath -FileMask "permissions.sqlite*" -FolderName "Permissions_$UserName"
# Places
$UserPath = "$($_.FullName)\AppData\Roaming\Mozilla\Firefox\Profiles\*"
Collect-Artifact -SourceDir $UserPath -FileMask "places.sqlite*" -FolderName "Places_$UserName"
# Protections
$UserPath = "$($_.FullName)\AppData\Roaming\Mozilla\Firefox\Profiles\*"
Collect-Artifact -SourceDir $UserPath -FileMask "protections.sqlite*" -FolderName "Protections_$UserName"
# Search
$UserPath = "$($_.FullName)\AppData\Roaming\Mozilla\Firefox\Profiles\*"
Collect-Artifact -SourceDir $UserPath -FileMask "search.sqlite*" -FolderName "Search_$UserName"
# Signons
$UserPath = "$($_.FullName)\AppData\Roaming\Mozilla\Firefox\Profiles\*"
Collect-Artifact -SourceDir $UserPath -FileMask "signons.sqlite*" -FolderName "Signons_$UserName"
# Storage Sync
$UserPath = "$($_.FullName)\AppData\Roaming\Mozilla\Firefox\Profiles\*"
Collect-Artifact -SourceDir $UserPath -FileMask "storage-sync.sqlite*" -FolderName "Storage_Sync_$UserName"
# Webappstore
$UserPath = "$($_.FullName)\AppData\Roaming\Mozilla\Firefox\Profiles\*"
Collect-Artifact -SourceDir $UserPath -FileMask "webappstore.sqlite*" -FolderName "Webappstore_$UserName"
# Password
$UserPath = "$($_.FullName)\AppData\Roaming\Mozilla\Firefox\Profiles\*"
Collect-Artifact -SourceDir $UserPath -FileMask "key*.db" -FolderName "Password_$UserName"
# Password
$UserPath = "$($_.FullName)\AppData\Roaming\Mozilla\Firefox\Profiles\*"
Collect-Artifact -SourceDir $UserPath -FileMask "signon*.*" -FolderName "Password_$UserName"
# Password
$UserPath = "$($_.FullName)\AppData\Roaming\Mozilla\Firefox\Profiles\*"
Collect-Artifact -SourceDir $UserPath -FileMask "logins.json" -FolderName "Password_$UserName"
# Preferences
$UserPath = "$($_.FullName)\AppData\Roaming\Mozilla\Firefox\Profiles\*"
Collect-Artifact -SourceDir $UserPath -FileMask "prefs.js" -FolderName "Preferences_$UserName"
# Sessionstore
$UserPath = "$($_.FullName)\AppData\Roaming\Mozilla\Firefox\Profiles\*"
Collect-Artifact -SourceDir $UserPath -FileMask "sessionstore*" -FolderName "Sessionstore_$UserName"
# Sessionstore Folder
$UserPath = "$($_.FullName)\AppData\Roaming\Mozilla\Firefox\Profiles\*\sessionstore-backups"
Collect-Artifact -SourceDir $UserPath -FolderName "Sessionstore_Folder_$UserName"
# Places XP
$UserPath = "$($_.FullName)\Application Data\Mozilla\Firefox\Profiles\*"
Collect-Artifact -SourceDir $UserPath -FileMask "places.sqlite*" -FolderName "Places_XP_$UserName"
# Downloads XP
$UserPath = "$($_.FullName)\Application Data\Mozilla\Firefox\Profiles\*"
Collect-Artifact -SourceDir $UserPath -FileMask "downloads.sqlite*" -FolderName "Downloads_XP_$UserName"
# Form history XP
$UserPath = "$($_.FullName)\Application Data\Mozilla\Firefox\Profiles\*"
Collect-Artifact -SourceDir $UserPath -FileMask "formhistory.sqlite*" -FolderName "Form_history_XP_$UserName"
# Cookies XP
$UserPath = "$($_.FullName)\Application Data\Mozilla\Firefox\Profiles\*"
Collect-Artifact -SourceDir $UserPath -FileMask "cookies.sqlite*" -FolderName "Cookies_XP_$UserName"
# Signons XP
$UserPath = "$($_.FullName)\Application Data\Mozilla\Firefox\Profiles\*"
Collect-Artifact -SourceDir $UserPath -FileMask "signons.sqlite*" -FolderName "Signons_XP_$UserName"
# Webappstore XP
$UserPath = "$($_.FullName)\Application Data\Mozilla\Firefox\Profiles\*"
Collect-Artifact -SourceDir $UserPath -FileMask "webappstore.sqlite*" -FolderName "Webappstore_XP_$UserName"
# Favicons XP
$UserPath = "$($_.FullName)\Application Data\Mozilla\Firefox\Profiles\*"
Collect-Artifact -SourceDir $UserPath -FileMask "favicons.sqlite*" -FolderName "Favicons_XP_$UserName"
# Addons XP
$UserPath = "$($_.FullName)\Application Data\Mozilla\Firefox\Profiles\*"
Collect-Artifact -SourceDir $UserPath -FileMask "addons.sqlite*" -FolderName "Addons_XP_$UserName"
# Search XP
$UserPath = "$($_.FullName)\Application Data\Mozilla\Firefox\Profiles\*"
Collect-Artifact -SourceDir $UserPath -FileMask "search.sqlite*" -FolderName "Search_XP_$UserName"
# Password XP
$UserPath = "$($_.FullName)\Application Data\Mozilla\Firefox\Profiles\*"
Collect-Artifact -SourceDir $UserPath -FileMask "key*.db" -FolderName "Password_XP_$UserName"
# Password XP
$UserPath = "$($_.FullName)\Application Data\Mozilla\Firefox\Profiles\*"
Collect-Artifact -SourceDir $UserPath -FileMask "signon*.*" -FolderName "Password_XP_$UserName"
# Password XP
$UserPath = "$($_.FullName)\Application Data\Mozilla\Firefox\Profiles\*"
Collect-Artifact -SourceDir $UserPath -FileMask "logins.json" -FolderName "Password_XP_$UserName"
# Sessionstore XP
$UserPath = "$($_.FullName)\Application Data\Mozilla\Firefox\Profiles\*"
Collect-Artifact -SourceDir $UserPath -FileMask "sessionstore*" -FolderName "Sessionstore_XP_$UserName"
# Index.dat History
$UserPath = "$($_.FullName)\Local Settings\History\History.IE5"
Collect-Artifact -SourceDir $UserPath -FileMask "index.dat" -FolderName "Index_dat_History_$UserName"
# Index.dat History subdirectory
$UserPath = "$($_.FullName)\Local Settings\History\History.IE5\*"
Collect-Artifact -SourceDir $UserPath -FileMask "index.dat" -FolderName "Index_dat_History_subdirectory_$UserName"
# Index.dat cookies
$UserPath = "$($_.FullName)\Cookies"
Collect-Artifact -SourceDir $UserPath -FileMask "index.dat" -FolderName "Index_dat_cookies_$UserName"
# Index.dat UserData
$UserPath = "$($_.FullName)\Application Data\Microsoft\Internet Explorer\UserData"
Collect-Artifact -SourceDir $UserPath -FileMask "index.dat" -FolderName "Index_dat_UserData_$UserName"
# Index.dat Office XP
$UserPath = "$($_.FullName)\Application Data\Microsoft\Office\Recent"
Collect-Artifact -SourceDir $UserPath -FileMask "index.dat" -FolderName "Index_dat_Office_XP_$UserName"
# Index.dat Office
$UserPath = "$($_.FullName)\AppData\Roaming\Microsoft\Office\Recent"
Collect-Artifact -SourceDir $UserPath -FileMask "index.dat" -FolderName "Index_dat_Office_$UserName"
# Local Internet Explorer folder
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Internet Explorer"
Collect-Artifact -SourceDir $UserPath -FolderName "Local_Internet_Explorer_folder_$UserName"
# Roaming Internet Explorer folder
$UserPath = "$($_.FullName)\AppData\Roaming\Microsoft\Internet Explorer"
Collect-Artifact -SourceDir $UserPath -FolderName "Roaming_Internet_Explorer_folder_$UserName"
# IE 9/10 History
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Windows\History"
Collect-Artifact -SourceDir $UserPath -FolderName "IE_9_10_History_$UserName"
# IE 9/10 Cookies
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Windows\Cookies"
Collect-Artifact -SourceDir $UserPath -FolderName "IE_9_10_Cookies_$UserName"
# IE 9/10 Download History
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Windows\IEDownloadHistory"
Collect-Artifact -SourceDir $UserPath -FolderName "IE_9_10_Download_History_$UserName"
# IE 11 Metadata
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Windows\WebCache"
Collect-Artifact -SourceDir $UserPath -FolderName "IE_11_Metadata_$UserName"
# IE 11 Cookies
$UserPath = "$($_.FullName)\AppData\Local\Microsoft\Windows\INetCookies"
Collect-Artifact -SourceDir $UserPath -FolderName "IE_11_Cookies_$UserName"
# Opera - Local Folder
$UserPath = "$($_.FullName)\AppData\Local\Opera Software\Opera Stable"
Collect-Artifact -SourceDir $UserPath -FolderName "Opera_Local_Folder_$UserName"
# Opera - Roaming Folder
$UserPath = "$($_.FullName)\AppData\Roaming\Opera Software\Opera Stable"
Collect-Artifact -SourceDir $UserPath -FolderName "Opera_Roaming_Folder_$UserName"
# Prisma Access Browser bookmarks XP
$UserPath = "$($_.FullName)\Local Settings\Application Data\Palo Alto Networks\PrismaAccessBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Bookmarks*" -FolderName "Prisma_Access_Browser_bookmarks_XP_$UserName"
# Prisma Access Browser Cookies XP
$UserPath = "$($_.FullName)\Local Settings\Application Data\Palo Alto Networks\PrismaAccessBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Cookies*" -FolderName "Prisma_Access_Browser_Cookies_XP_$UserName"
# Prisma Access Browser Current Session XP
$UserPath = "$($_.FullName)\Local Settings\Application Data\Palo Alto Networks\PrismaAccessBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Current Session" -FolderName "Prisma_Access_Browser_Current_Session_XP_$UserName"
# Prisma Access Browser Current Tabs XP
$UserPath = "$($_.FullName)\Local Settings\Application Data\Palo Alto Networks\PrismaAccessBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Current Tabs" -FolderName "Prisma_Access_Browser_Current_Tabs_XP_$UserName"
# Prisma Access Browser Favicons XP
$UserPath = "$($_.FullName)\Local Settings\Application Data\Palo Alto Networks\PrismaAccessBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Favicons*" -FolderName "Prisma_Access_Browser_Favicons_XP_$UserName"
# Prisma Access Browser History XP
$UserPath = "$($_.FullName)\Local Settings\Application Data\Palo Alto Networks\PrismaAccessBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "History*" -FolderName "Prisma_Access_Browser_History_XP_$UserName"
# Prisma Access Browser Last Session XP
$UserPath = "$($_.FullName)\Local Settings\Application Data\Palo Alto Networks\PrismaAccessBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Last Session" -FolderName "Prisma_Access_Browser_Last_Session_XP_$UserName"
# Prisma Access Browser Last Tabs XP
$UserPath = "$($_.FullName)\Local Settings\Application Data\Palo Alto Networks\PrismaAccessBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Last Tabs" -FolderName "Prisma_Access_Browser_Last_Tabs_XP_$UserName"
# Prisma Access Browser Login Data XP
$UserPath = "$($_.FullName)\Local Settings\Application Data\Palo Alto Networks\PrismaAccessBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Login Data" -FolderName "Prisma_Access_Browser_Login_Data_XP_$UserName"
# Prisma Access Browser Preferences XP
$UserPath = "$($_.FullName)\Local Settings\Application Data\Palo Alto Networks\PrismaAccessBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Preferences" -FolderName "Prisma_Access_Browser_Preferences_XP_$UserName"
# Prisma Access Browser Shortcuts XP
$UserPath = "$($_.FullName)\Local Settings\Application Data\Palo Alto Networks\PrismaAccessBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Shortcuts*" -FolderName "Prisma_Access_Browser_Shortcuts_XP_$UserName"
# Prisma Access Browser Top Sites XP
$UserPath = "$($_.FullName)\Local Settings\Application Data\Palo Alto Networks\PrismaAccessBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Top Sites*" -FolderName "Prisma_Access_Browser_Top_Sites_XP_$UserName"
# Prisma Access Browser Visited Links XP
$UserPath = "$($_.FullName)\Local Settings\Application Data\Palo Alto Networks\PrismaAccessBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Visited Links" -FolderName "Prisma_Access_Browser_Visited_Links_XP_$UserName"
# Prisma Access Browser Web Data XP
$UserPath = "$($_.FullName)\Local Settings\Application Data\Palo Alto Networks\PrismaAccessBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Web Data*" -FolderName "Prisma_Access_Browser_Web_Data_XP_$UserName"
# Prisma Access Browser bookmarks
$UserPath = "$($_.FullName)\AppData\Local\Palo Alto Networks\PrismaAccessBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Bookmarks*" -FolderName "Prisma_Access_Browser_bookmarks_$UserName"
# Prisma Access Browser Cookies
$UserPath = "$($_.FullName)\AppData\Local\Palo Alto Networks\PrismaAccessBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Cookies*" -FolderName "Prisma_Access_Browser_Cookies_$UserName"
# Prisma Access Browser Current Session
$UserPath = "$($_.FullName)\AppData\Local\Palo Alto Networks\PrismaAccessBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Current Session" -FolderName "Prisma_Access_Browser_Current_Session_$UserName"
# Prisma Access Browser Current Tabs
$UserPath = "$($_.FullName)\AppData\Local\Palo Alto Networks\PrismaAccessBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Current Tabs" -FolderName "Prisma_Access_Browser_Current_Tabs_$UserName"
# Prisma Access Browser Download Metadata
$UserPath = "$($_.FullName)\AppData\Local\Palo Alto Networks\PrismaAccessBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "DownloadMetadata" -FolderName "Prisma_Access_Browser_Download_Metadata_$UserName"
# Prisma Access Browser Extension Cookies
$UserPath = "$($_.FullName)\AppData\Local\Palo Alto Networks\PrismaAccessBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Extension Cookies" -FolderName "Prisma_Access_Browser_Extension_Cookies_$UserName"
# Prisma Access Browser Favicons
$UserPath = "$($_.FullName)\AppData\Local\Palo Alto Networks\PrismaAccessBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Favicons*" -FolderName "Prisma_Access_Browser_Favicons_$UserName"
# Prisma Access Browser History
$UserPath = "$($_.FullName)\AppData\Local\Palo Alto Networks\PrismaAccessBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "History*" -FolderName "Prisma_Access_Browser_History_$UserName"
# Prisma Access Browser Last Session
$UserPath = "$($_.FullName)\AppData\Local\Palo Alto Networks\PrismaAccessBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Last Session" -FolderName "Prisma_Access_Browser_Last_Session_$UserName"
# Prisma Access Browser Last Tabs
$UserPath = "$($_.FullName)\AppData\Local\Palo Alto Networks\PrismaAccessBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Last Tabs" -FolderName "Prisma_Access_Browser_Last_Tabs_$UserName"
# Prisma Access Browser Sessions Folder
$UserPath = "$($_.FullName)\AppData\Local\Palo Alto Networks\PrismaAccessBrowser\User Data\*\Sessions"
Collect-Artifact -SourceDir $UserPath -FolderName "Prisma_Access_Browser_Sessions_Folder_$UserName"
# Prisma Access Browser Login Data
$UserPath = "$($_.FullName)\AppData\Local\Palo Alto Networks\PrismaAccessBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Login Data" -FolderName "Prisma_Access_Browser_Login_Data_$UserName"
# Prisma Access Browser Media History
$UserPath = "$($_.FullName)\AppData\Local\Palo Alto Networks\PrismaAccessBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Media History*" -FolderName "Prisma_Access_Browser_Media_History_$UserName"
# Prisma Access Browser Network Action Predictor
$UserPath = "$($_.FullName)\AppData\Local\Palo Alto Networks\PrismaAccessBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Network Action Predictor" -FolderName "Prisma_Access_Browser_Network_Action_Predictor_$UserName"
# Prisma Access Browser Network Persistent State
$UserPath = "$($_.FullName)\AppData\Local\Palo Alto Networks\PrismaAccessBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Network Persistent State" -FolderName "Prisma_Access_Browser_Network_Persistent_State_$UserName"
# Prisma Access Browser Preferences
$UserPath = "$($_.FullName)\AppData\Local\Palo Alto Networks\PrismaAccessBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Preferences" -FolderName "Prisma_Access_Browser_Preferences_$UserName"
# Prisma Access Browser Secure Preferences
$UserPath = "$($_.FullName)\AppData\Local\Palo Alto Networks\PrismaAccessBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Secure Preferences" -FolderName "Prisma_Access_Browser_Secure_Preferences_$UserName"
# Prisma Access Browser Quota Manager
$UserPath = "$($_.FullName)\AppData\Local\Palo Alto Networks\PrismaAccessBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "QuotaManager" -FolderName "Prisma_Access_Browser_Quota_Manager_$UserName"
# Prisma Access Browser Reporting and NEL
$UserPath = "$($_.FullName)\AppData\Local\Palo Alto Networks\PrismaAccessBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Reporting and NEL" -FolderName "Prisma_Access_Browser_Reporting_and_NEL_$UserName"
# Prisma Access Browser Shortcuts
$UserPath = "$($_.FullName)\AppData\Local\Palo Alto Networks\PrismaAccessBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Shortcuts*" -FolderName "Prisma_Access_Browser_Shortcuts_$UserName"
# Prisma Access Browser Top Sites
$UserPath = "$($_.FullName)\AppData\Local\Palo Alto Networks\PrismaAccessBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Top Sites*" -FolderName "Prisma_Access_Browser_Top_Sites_$UserName"
# Prisma Access Browser Trust Tokens
$UserPath = "$($_.FullName)\AppData\Local\Palo Alto Networks\PrismaAccessBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Trust Tokens*" -FolderName "Prisma_Access_Browser_Trust_Tokens_$UserName"
# Prisma Access Browser SyncData Database
$UserPath = "$($_.FullName)\AppData\Local\Palo Alto Networks\PrismaAccessBrowser\User Data\*\Sync Data"
Collect-Artifact -SourceDir $UserPath -FileMask "SyncData.sqlite3" -FolderName "Prisma_Access_Browser_SyncData_Database_$UserName"
# Prisma Access Browser Visited Links
$UserPath = "$($_.FullName)\AppData\Local\Palo Alto Networks\PrismaAccessBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Visited Links" -FolderName "Prisma_Access_Browser_Visited_Links_$UserName"
# Prisma Access Browser Web Data
$UserPath = "$($_.FullName)\AppData\Local\Palo Alto Networks\PrismaAccessBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Web Data*" -FolderName "Prisma_Access_Browser_Web_Data_$UserName"
# Windows Protect Folder
$UserPath = "$($_.FullName)\AppData\Roaming\Microsoft\Protect\*"
Collect-Artifact -SourceDir $UserPath -FolderName "Windows_Protect_Folder_$UserName"
# Prisma Access Browser Snapshots Folder
$UserPath = "$($_.FullName)\AppData\Local\Palo Alto Networks\PrismaAccessBrowser\User Data\Snapshots\*"
Collect-Artifact -SourceDir $UserPath -FolderName "Prisma_Access_Browser_Snapshots_Folder_$UserName"
# Prisma Access Browser User Data Backup Folder
$UserPath = "$($_.FullName)\AppData\Local\Palo Alto Networks\PrismaAccessBrowser\User Data Backup"
Collect-Artifact -SourceDir $UserPath -FolderName "Prisma_Access_Browser_User_Data_Backup_Folder_$UserName"
# Puffin - data.db
$UserPath = "$($_.FullName)\AppData\Local\PuffinSecureBrowser"
Collect-Artifact -SourceDir $UserPath -FileMask "data.db" -FolderName "Puffin_data_db_$UserName"
# Puffin - Autocomplete Data
$UserPath = "$($_.FullName)\AppData\Local\PuffinSecureBrowser"
Collect-Artifact -SourceDir $UserPath -FileMask "autocompletes.dat" -FolderName "Puffin_Autocomplete_Data_$UserName"
# Puffin - Password Forms Data
$UserPath = "$($_.FullName)\AppData\Local\PuffinSecureBrowser"
Collect-Artifact -SourceDir $UserPath -FileMask "passwordForms.dat" -FolderName "Puffin_Password_Forms_Data_$UserName"
# Puffin - Password (Encrypted)
$UserPath = "$($_.FullName)\AppData\Local\PuffinSecureBrowser"
Collect-Artifact -SourceDir $UserPath -FileMask "credential.dat" -FolderName "Puffin_Password_Encrypted_$UserName"
# Puffin - Subscription Data
$UserPath = "$($_.FullName)\AppData\Local\PuffinSecureBrowser"
Collect-Artifact -SourceDir $UserPath -FileMask "subscription" -FolderName "Puffin_Subscription_Data_$UserName"
# Puffin - Cookies
$UserPath = "$($_.FullName)\AppData\Local\PuffinSecureBrowser"
Collect-Artifact -SourceDir $UserPath -FileMask "cookies.dat" -FolderName "Puffin_Cookies_$UserName"
# Puffin - Image Cache
$UserPath = "$($_.FullName)\AppData\Local\PuffinSecureBrowser\image_cache"
Collect-Artifact -SourceDir $UserPath -FolderName "Puffin_Image_Cache_$UserName"
# QQ Browser Bookmarks
$UserPath = "$($_.FullName)\AppData\Local\Tencent\QQBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Bookmarks*" -FolderName "QQ_Browser_Bookmarks_$UserName"
# QQ Browser Cookies
$UserPath = "$($_.FullName)\AppData\Local\Tencent\QQBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Cookies*" -FolderName "QQ_Browser_Cookies_$UserName"
# QQ Browser Current Session
$UserPath = "$($_.FullName)\AppData\Local\Tencent\QQBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Current Session" -FolderName "QQ_Browser_Current_Session_$UserName"
# QQ Browser Current Tabs
$UserPath = "$($_.FullName)\AppData\Local\Tencent\QQBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Current Tabs" -FolderName "QQ_Browser_Current_Tabs_$UserName"
# QQ Browser Download Metadata
$UserPath = "$($_.FullName)\AppData\Local\Tencent\QQBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "DownloadMetadata" -FolderName "QQ_Browser_Download_Metadata_$UserName"
# QQ Browser Extension Cookies
$UserPath = "$($_.FullName)\AppData\Local\Tencent\QQBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Extension Cookies" -FolderName "QQ_Browser_Extension_Cookies_$UserName"
# QQ Browser Favicons
$UserPath = "$($_.FullName)\AppData\Local\Tencent\QQBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Favicons*" -FolderName "QQ_Browser_Favicons_$UserName"
# QQ Browser History
$UserPath = "$($_.FullName)\AppData\Local\Tencent\QQBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "History*" -FolderName "QQ_Browser_History_$UserName"
# QQ Browser Last Session
$UserPath = "$($_.FullName)\AppData\Local\Tencent\QQBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Last Session" -FolderName "QQ_Browser_Last_Session_$UserName"
# QQ Browser Last Tabs
$UserPath = "$($_.FullName)\AppData\Local\Tencent\QQBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Last Tabs" -FolderName "QQ_Browser_Last_Tabs_$UserName"
# QQ Browser Sessions Folder
$UserPath = "$($_.FullName)\AppData\Local\Tencent\QQBrowser\User Data\*\Sessions"
Collect-Artifact -SourceDir $UserPath -FolderName "QQ_Browser_Sessions_Folder_$UserName"
# QQ Browser Login Data
$UserPath = "$($_.FullName)\AppData\Local\Tencent\QQBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Login Data*" -FolderName "QQ_Browser_Login_Data_$UserName"
# QQ Browser Media History
$UserPath = "$($_.FullName)\AppData\Local\Tencent\QQBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Media History*" -FolderName "QQ_Browser_Media_History_$UserName"
# QQ Browser Network Action Predictor
$UserPath = "$($_.FullName)\AppData\Local\Tencent\QQBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Network Action Predictor" -FolderName "QQ_Browser_Network_Action_Predictor_$UserName"
# QQ Browser Network Persistent State
$UserPath = "$($_.FullName)\AppData\Local\Tencent\QQBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Network Persistent State" -FolderName "QQ_Browser_Network_Persistent_State_$UserName"
# QQ Browser Preferences
$UserPath = "$($_.FullName)\AppData\Local\Tencent\QQBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Preferences" -FolderName "QQ_Browser_Preferences_$UserName"
# QQ Browser Quota Manager
$UserPath = "$($_.FullName)\AppData\Local\Tencent\QQBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "QuotaManager" -FolderName "QQ_Browser_Quota_Manager_$UserName"
# QQ Browser Reporting and NEL
$UserPath = "$($_.FullName)\AppData\Local\Tencent\QQBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Reporting and NEL" -FolderName "QQ_Browser_Reporting_and_NEL_$UserName"
# QQ Browser Shortcuts
$UserPath = "$($_.FullName)\AppData\Local\Tencent\QQBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Shortcuts*" -FolderName "QQ_Browser_Shortcuts_$UserName"
# QQ Browser Top Sites
$UserPath = "$($_.FullName)\AppData\Local\Tencent\QQBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Top Sites*" -FolderName "QQ_Browser_Top_Sites_$UserName"
# QQ Browser Trust Tokens
$UserPath = "$($_.FullName)\AppData\Local\Tencent\QQBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Trust Tokens*" -FolderName "QQ_Browser_Trust_Tokens_$UserName"
# QQ Browser SyncData Database
$UserPath = "$($_.FullName)\AppData\Local\Tencent\QQBrowser\User Data\*\Sync Data"
Collect-Artifact -SourceDir $UserPath -FolderName "QQ_Browser_SyncData_Database_$UserName"
# QQ Browser Visited Links
$UserPath = "$($_.FullName)\AppData\Local\Tencent\QQBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Visited Links" -FolderName "QQ_Browser_Visited_Links_$UserName"
# QQ Browser Web Data
$UserPath = "$($_.FullName)\AppData\Local\Tencent\QQBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Web Data*" -FolderName "QQ_Browser_Web_Data_$UserName"
# Windows Protect Folder
$UserPath = "$($_.FullName)\AppData\Roaming\Microsoft\Protect\*"
Collect-Artifact -SourceDir $UserPath -FolderName "Windows_Protect_Folder_$UserName"
# QQ Browser Snapshots Folder
$UserPath = "$($_.FullName)\AppData\Local\Tencent\QQBrowser\User Data\Snapshots\*"
Collect-Artifact -SourceDir $UserPath -FolderName "QQ_Browser_Snapshots_Folder_$UserName"
# Supermium Bookmarks XP
$UserPath = "$($_.FullName)\Application Data\Supermium\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Bookmarks*" -FolderName "Supermium_Bookmarks_XP_$UserName"
# Supermium Cookies XP
$UserPath = "$($_.FullName)\Application Data\Supermium\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Cookies*" -FolderName "Supermium_Cookies_XP_$UserName"
# Supermium Current Session XP
$UserPath = "$($_.FullName)\Application Data\Supermium\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Current Session" -FolderName "Supermium_Current_Session_XP_$UserName"
# Supermium Current Tabs XP
$UserPath = "$($_.FullName)\Application Data\Supermium\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Current Tabs" -FolderName "Supermium_Current_Tabs_XP_$UserName"
# Supermium Favicons XP
$UserPath = "$($_.FullName)\Application Data\Supermium\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Favicons*" -FolderName "Supermium_Favicons_XP_$UserName"
# Supermium History XP
$UserPath = "$($_.FullName)\Application Data\Supermium\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "History*" -FolderName "Supermium_History_XP_$UserName"
# Supermium Last Session XP
$UserPath = "$($_.FullName)\Application Data\Supermium\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Last Session" -FolderName "Supermium_Last_Session_XP_$UserName"
# Supermium Last Tabs XP
$UserPath = "$($_.FullName)\Application Data\Supermium\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Last Tabs" -FolderName "Supermium_Last_Tabs_XP_$UserName"
# Supermium Sessions Folder XP
$UserPath = "$($_.FullName)\Application Data\Supermium\User Data\*\Sessions"
Collect-Artifact -SourceDir $UserPath -FolderName "Supermium_Sessions_Folder_XP_$UserName"
# Supermium Network Action Predictor XP
$UserPath = "$($_.FullName)\Application Data\Supermium\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Network Action Predictor" -FolderName "Supermium_Network_Action_Predictor_XP_$UserName"
# Supermium Network Persistent State XP
$UserPath = "$($_.FullName)\Application Data\Supermium\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Network Persistent State" -FolderName "Supermium_Network_Persistent_State_XP_$UserName"
# Supermium Login Data XP
$UserPath = "$($_.FullName)\Application Data\Supermium\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Login Data*" -FolderName "Supermium_Login_Data_XP_$UserName"
# Supermium Preferences XP
$UserPath = "$($_.FullName)\Application Data\Supermium\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Preferences" -FolderName "Supermium_Preferences_XP_$UserName"
# Supermium Reporting and NEL XP
$UserPath = "$($_.FullName)\Application Data\Supermium\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Reporting and NEL" -FolderName "Supermium_Reporting_and_NEL_XP_$UserName"
# Supermium Trust Tokens XP
$UserPath = "$($_.FullName)\Application Data\Supermium\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Trust Tokens*" -FolderName "Supermium_Trust_Tokens_XP_$UserName"
# Supermium SyncData Database XP
$UserPath = "$($_.FullName)\Application Data\Supermium\User Data\*\Sync Data"
Collect-Artifact -SourceDir $UserPath -FolderName "Supermium_SyncData_Database_XP_$UserName"
# Supermium Shortcuts XP
$UserPath = "$($_.FullName)\Application Data\Supermium\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Shortcuts*" -FolderName "Supermium_Shortcuts_XP_$UserName"
# Supermium Top Sites XP
$UserPath = "$($_.FullName)\Application Data\Supermium\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Top Sites*" -FolderName "Supermium_Top_Sites_XP_$UserName"
# Supermium Visited Links XP
$UserPath = "$($_.FullName)\Application Data\Supermium\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Visited Links" -FolderName "Supermium_Visited_Links_XP_$UserName"
# Supermium Web Data XP
$UserPath = "$($_.FullName)\Application Data\Supermium\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Web Data*" -FolderName "Supermium_Web_Data_XP_$UserName"
# Supermium Bookmarks
$UserPath = "$($_.FullName)\AppData\Local\Supermium\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Bookmarks*" -FolderName "Supermium_Bookmarks_$UserName"
# Supermium Cookies
$UserPath = "$($_.FullName)\AppData\Local\Supermium\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Cookies*" -FolderName "Supermium_Cookies_$UserName"
# Supermium Current Session
$UserPath = "$($_.FullName)\AppData\Local\Supermium\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Current Session" -FolderName "Supermium_Current_Session_$UserName"
# Supermium Current Tabs
$UserPath = "$($_.FullName)\AppData\Local\Supermium\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Current Tabs" -FolderName "Supermium_Current_Tabs_$UserName"
# Supermium Download Metadata
$UserPath = "$($_.FullName)\AppData\Local\Supermium\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "DownloadMetadata" -FolderName "Supermium_Download_Metadata_$UserName"
# Supermium Extension Cookies
$UserPath = "$($_.FullName)\AppData\Local\Supermium\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Extension Cookies" -FolderName "Supermium_Extension_Cookies_$UserName"
# Supermium Favicons
$UserPath = "$($_.FullName)\AppData\Local\Supermium\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Favicons*" -FolderName "Supermium_Favicons_$UserName"
# Supermium History
$UserPath = "$($_.FullName)\AppData\Local\Supermium\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "History*" -FolderName "Supermium_History_$UserName"
# Supermium Last Session
$UserPath = "$($_.FullName)\AppData\Local\Supermium\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Last Session" -FolderName "Supermium_Last_Session_$UserName"
# Supermium Last Tabs
$UserPath = "$($_.FullName)\AppData\Local\Supermium\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Last Tabs" -FolderName "Supermium_Last_Tabs_$UserName"
# Supermium Sessions Folder
$UserPath = "$($_.FullName)\AppData\Local\Supermium\User Data\*\Sessions"
Collect-Artifact -SourceDir $UserPath -FolderName "Supermium_Sessions_Folder_$UserName"
# Supermium Login Data
$UserPath = "$($_.FullName)\AppData\Local\Supermium\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Login Data*" -FolderName "Supermium_Login_Data_$UserName"
# Supermium Media History
$UserPath = "$($_.FullName)\AppData\Local\Supermium\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Media History*" -FolderName "Supermium_Media_History_$UserName"
# Supermium Network Action Predictor
$UserPath = "$($_.FullName)\AppData\Local\Supermium\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Network Action Predictor" -FolderName "Supermium_Network_Action_Predictor_$UserName"
# Supermium Network Persistent State
$UserPath = "$($_.FullName)\AppData\Local\Supermium\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Network Persistent State" -FolderName "Supermium_Network_Persistent_State_$UserName"
# Supermium Preferences
$UserPath = "$($_.FullName)\AppData\Local\Supermium\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Preferences" -FolderName "Supermium_Preferences_$UserName"
# Supermium Secure Preferences
$UserPath = "$($_.FullName)\AppData\Local\Supermium\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Secure Preferences" -FolderName "Supermium_Secure_Preferences_$UserName"
# Supermium Quota Manager
$UserPath = "$($_.FullName)\AppData\Local\Supermium\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "QuotaManager" -FolderName "Supermium_Quota_Manager_$UserName"
# Supermium Reporting and NEL
$UserPath = "$($_.FullName)\AppData\Local\Supermium\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Reporting and NEL" -FolderName "Supermium_Reporting_and_NEL_$UserName"
# Supermium Shortcuts
$UserPath = "$($_.FullName)\AppData\Local\Supermium\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Shortcuts*" -FolderName "Supermium_Shortcuts_$UserName"
# Supermium Top Sites
$UserPath = "$($_.FullName)\AppData\Local\Supermium\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Top Sites*" -FolderName "Supermium_Top_Sites_$UserName"
# Supermium Trust Tokens
$UserPath = "$($_.FullName)\AppData\Local\Supermium\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Trust Tokens*" -FolderName "Supermium_Trust_Tokens_$UserName"
# Supermium SyncData Database
$UserPath = "$($_.FullName)\AppData\Local\Supermium\User Data\*\Sync Data"
Collect-Artifact -SourceDir $UserPath -FolderName "Supermium_SyncData_Database_$UserName"
# Supermium Visited Links
$UserPath = "$($_.FullName)\AppData\Local\Supermium\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Visited Links" -FolderName "Supermium_Visited_Links_$UserName"
# Supermium Web Data
$UserPath = "$($_.FullName)\AppData\Local\Supermium\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Web Data*" -FolderName "Supermium_Web_Data_$UserName"
# Windows Protect Folder
$UserPath = "$($_.FullName)\AppData\Roaming\Microsoft\Protect\*"
Collect-Artifact -SourceDir $UserPath -FolderName "Windows_Protect_Folder_$UserName"
# Supermium Snapshots Folder
$UserPath = "$($_.FullName)\AppData\Local\Supermium\User Data\Snapshots\*"
Collect-Artifact -SourceDir $UserPath -FolderName "Supermium_Snapshots_Folder_$UserName"
# UCBrowser Bookmarks
$UserPath = "$($_.FullName)\AppData\Local\UCBrowser\User Data*\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Bookmarks*" -FolderName "UCBrowser_Bookmarks_$UserName"
# UCBrowser Cookies
$UserPath = "$($_.FullName)\AppData\Local\UCBrowser\User Data*\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Cookies*" -FolderName "UCBrowser_Cookies_$UserName"
# UCBrowser Current Session
$UserPath = "$($_.FullName)\AppData\Local\UCBrowser\User Data*\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Current Session" -FolderName "UCBrowser_Current_Session_$UserName"
# UCBrowser Current Tabs
$UserPath = "$($_.FullName)\AppData\Local\UCBrowser\User Data*\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Current Tabs" -FolderName "UCBrowser_Current_Tabs_$UserName"
# UCBrowser Download Metadata
$UserPath = "$($_.FullName)\AppData\Local\UCBrowser\User Data*\*"
Collect-Artifact -SourceDir $UserPath -FileMask "DownloadMetadata" -FolderName "UCBrowser_Download_Metadata_$UserName"
# UCBrowser Extension Cookies
$UserPath = "$($_.FullName)\AppData\Local\UCBrowser\User Data*\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Extension Cookies" -FolderName "UCBrowser_Extension_Cookies_$UserName"
# UCBrowser Favicons
$UserPath = "$($_.FullName)\AppData\Local\UCBrowser\User Data*\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Favicons*" -FolderName "UCBrowser_Favicons_$UserName"
# UCBrowser History
$UserPath = "$($_.FullName)\AppData\Local\UCBrowser\User Data*\*"
Collect-Artifact -SourceDir $UserPath -FileMask "History*" -FolderName "UCBrowser_History_$UserName"
# UCBrowser Last Session
$UserPath = "$($_.FullName)\AppData\Local\UCBrowser\User Data*\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Last Session" -FolderName "UCBrowser_Last_Session_$UserName"
# UCBrowser Last Tabs
$UserPath = "$($_.FullName)\AppData\Local\UCBrowser\User Data*\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Last Tabs" -FolderName "UCBrowser_Last_Tabs_$UserName"
# UCBrowser Sessions Folder
$UserPath = "$($_.FullName)\AppData\Local\UCBrowser\User Data*\*\Sessions"
Collect-Artifact -SourceDir $UserPath -FolderName "UCBrowser_Sessions_Folder_$UserName"
# UCBrowser Login Data
$UserPath = "$($_.FullName)\AppData\Local\UCBrowser\User Data*\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Login Data*" -FolderName "UCBrowser_Login_Data_$UserName"
# UCBrowser Media History
$UserPath = "$($_.FullName)\AppData\Local\UCBrowser\User Data*\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Media History*" -FolderName "UCBrowser_Media_History_$UserName"
# UCBrowser Network Action Predictor
$UserPath = "$($_.FullName)\AppData\Local\UCBrowser\User Data*\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Network Action Predictor" -FolderName "UCBrowser_Network_Action_Predictor_$UserName"
# UCBrowser Network Persistent State
$UserPath = "$($_.FullName)\AppData\Local\UCBrowser\User Data*\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Network Persistent State" -FolderName "UCBrowser_Network_Persistent_State_$UserName"
# UCBrowser Preferences
$UserPath = "$($_.FullName)\AppData\Local\UCBrowser\User Data*\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Preferences" -FolderName "UCBrowser_Preferences_$UserName"
# UCBrowser Quota Manager
$UserPath = "$($_.FullName)\AppData\Local\UCBrowser\User Data*\*"
Collect-Artifact -SourceDir $UserPath -FileMask "QuotaManager" -FolderName "UCBrowser_Quota_Manager_$UserName"
# UCBrowser Reporting and NEL
$UserPath = "$($_.FullName)\AppData\Local\UCBrowser\User Data*\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Reporting and NEL" -FolderName "UCBrowser_Reporting_and_NEL_$UserName"
# UCBrowser Shortcuts
$UserPath = "$($_.FullName)\AppData\Local\UCBrowser\User Data*\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Shortcuts*" -FolderName "UCBrowser_Shortcuts_$UserName"
# UCBrowser Top Sites
$UserPath = "$($_.FullName)\AppData\Local\UCBrowser\User Data*\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Top Sites*" -FolderName "UCBrowser_Top_Sites_$UserName"
# UCBrowser Trust Tokens
$UserPath = "$($_.FullName)\AppData\Local\UCBrowser\User Data*\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Trust Tokens*" -FolderName "UCBrowser_Trust_Tokens_$UserName"
# UCBrowser SyncData Database
$UserPath = "$($_.FullName)\AppData\Local\UCBrowser\User Data*\*\Sync Data"
Collect-Artifact -SourceDir $UserPath -FolderName "UCBrowser_SyncData_Database_$UserName"
# UCBrowser Visited Links
$UserPath = "$($_.FullName)\AppData\Local\UCBrowser\User Data*\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Visited Links" -FolderName "UCBrowser_Visited_Links_$UserName"
# UCBrowser Web Data
$UserPath = "$($_.FullName)\AppData\Local\UCBrowser\User Data*\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Web Data*" -FolderName "UCBrowser_Web_Data_$UserName"
# Windows Protect Folder
$UserPath = "$($_.FullName)\AppData\Roaming\Microsoft\Protect\*"
Collect-Artifact -SourceDir $UserPath -FolderName "Windows_Protect_Folder_$UserName"
# UCBrowser Snapshots Folder
$UserPath = "$($_.FullName)\AppData\Local\UCBrowser\User Data*\Snapshots\*"
Collect-Artifact -SourceDir $UserPath -FolderName "UCBrowser_Snapshots_Folder_$UserName"
# Vivaldi Cookies
$UserPath = "$($_.FullName)\AppData\Local\Vivaldi\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Cookies*" -FolderName "Vivaldi_Cookies_$UserName"
# Vivaldi Network Persistent State
$UserPath = "$($_.FullName)\AppData\Local\Vivaldi\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Network Persistent State" -FolderName "Vivaldi_Network_Persistent_State_$UserName"
# Vivaldi Favicons
$UserPath = "$($_.FullName)\AppData\Local\Vivaldi\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Favicons*" -FolderName "Vivaldi_Favicons_$UserName"
# Vivaldi History
$UserPath = "$($_.FullName)\AppData\Local\Vivaldi\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "History*" -FolderName "Vivaldi_History_$UserName"
# Vivaldi Sessions Folder
$UserPath = "$($_.FullName)\AppData\Local\Vivaldi\User Data\*\Sessions"
Collect-Artifact -SourceDir $UserPath -FolderName "Vivaldi_Sessions_Folder_$UserName"
# Vivaldi Login Data
$UserPath = "$($_.FullName)\AppData\Local\Vivaldi\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Login Data" -FolderName "Vivaldi_Login_Data_$UserName"
# Vivaldi Network Action Predictor
$UserPath = "$($_.FullName)\AppData\Local\Vivaldi\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Network Action Predictor" -FolderName "Vivaldi_Network_Action_Predictor_$UserName"
# Vivaldi Preferences
$UserPath = "$($_.FullName)\AppData\Local\Vivaldi\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Preferences" -FolderName "Vivaldi_Preferences_$UserName"
# Vivaldi Secure Preferences
$UserPath = "$($_.FullName)\AppData\Local\Vivaldi\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Secure Preferences" -FolderName "Vivaldi_Secure_Preferences_$UserName"
# Vivaldi Top Sites
$UserPath = "$($_.FullName)\AppData\Local\Vivaldi\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Top Sites*" -FolderName "Vivaldi_Top_Sites_$UserName"
# Vivaldi Bookmarks
$UserPath = "$($_.FullName)\AppData\Local\Vivaldi\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Bookmarks*" -FolderName "Vivaldi_Bookmarks_$UserName"
# Vivaldi Visited Links
$UserPath = "$($_.FullName)\AppData\Local\Vivaldi\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Visited Links" -FolderName "Vivaldi_Visited_Links_$UserName"
# Vivaldi Web Data
$UserPath = "$($_.FullName)\AppData\Local\Vivaldi\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Web Data*" -FolderName "Vivaldi_Web_Data_$UserName"
# Vivaldi User Tracking
$UserPath = $_.FullName
Collect-Artifact -SourceDir $UserPath -FileMask ".vivaldi_reporting_data*" -FolderName "Vivaldi_User_Tracking_$UserName"
# Vivaldi Calendar
$UserPath = "$($_.FullName)\AppData\Local\Vivaldi\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Calendar*" -FolderName "Vivaldi_Calendar_$UserName"
# Vivaldi Contacts
$UserPath = "$($_.FullName)\AppData\Local\Vivaldi\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Contacts*" -FolderName "Vivaldi_Contacts_$UserName"
# Vivaldi Notes
$UserPath = "$($_.FullName)\AppData\Local\Vivaldi\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Notes*" -FolderName "Vivaldi_Notes_$UserName"
# Vivaldi Download Metadata
$UserPath = "$($_.FullName)\AppData\Local\Vivaldi\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "DownloadMetadata*" -FolderName "Vivaldi_Download_Metadata_$UserName"
# WaveBrowser bookmarks
$UserPath = "$($_.FullName)\AppData\Local\WaveBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Bookmarks*" -FolderName "WaveBrowser_bookmarks_$UserName"
# WaveBrowser Cookies
$UserPath = "$($_.FullName)\AppData\Local\WaveBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Cookies*" -FolderName "WaveBrowser_Cookies_$UserName"
# WaveBrowser Current Session
$UserPath = "$($_.FullName)\AppData\Local\WaveBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Current Session" -FolderName "WaveBrowser_Current_Session_$UserName"
# WaveBrowser Current Tabs
$UserPath = "$($_.FullName)\AppData\Local\WaveBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Current Tabs" -FolderName "WaveBrowser_Current_Tabs_$UserName"
# WaveBrowser Download Metadata
$UserPath = "$($_.FullName)\AppData\Local\WaveBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "DownloadMetadata" -FolderName "WaveBrowser_Download_Metadata_$UserName"
# WaveBrowser Extension Cookies
$UserPath = "$($_.FullName)\AppData\Local\WaveBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Extension Cookies" -FolderName "WaveBrowser_Extension_Cookies_$UserName"
# WaveBrowser Favicons
$UserPath = "$($_.FullName)\AppData\Local\WaveBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Favicons*" -FolderName "WaveBrowser_Favicons_$UserName"
# WaveBrowser History
$UserPath = "$($_.FullName)\AppData\Local\WaveBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "History*" -FolderName "WaveBrowser_History_$UserName"
# WaveBrowser Last Session
$UserPath = "$($_.FullName)\AppData\Local\WaveBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Last Session" -FolderName "WaveBrowser_Last_Session_$UserName"
# WaveBrowser Last Tabs
$UserPath = "$($_.FullName)\AppData\Local\WaveBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Last Tabs" -FolderName "WaveBrowser_Last_Tabs_$UserName"
# WaveBrowser Sessions Folder
$UserPath = "$($_.FullName)\AppData\Local\WaveBrowser\User Data\*\Sessions"
Collect-Artifact -SourceDir $UserPath -FolderName "WaveBrowser_Sessions_Folder_$UserName"
# WaveBrowser Login Data
$UserPath = "$($_.FullName)\AppData\Local\WaveBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Login Data" -FolderName "WaveBrowser_Login_Data_$UserName"
# WaveBrowser Media History
$UserPath = "$($_.FullName)\AppData\Local\WaveBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Media History*" -FolderName "WaveBrowser_Media_History_$UserName"
# WaveBrowser Network Action Predictor
$UserPath = "$($_.FullName)\AppData\Local\WaveBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Network Action Predictor" -FolderName "WaveBrowser_Network_Action_Predictor_$UserName"
# WaveBrowser Network Persistent State
$UserPath = "$($_.FullName)\AppData\Local\WaveBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Network Persistent State" -FolderName "WaveBrowser_Network_Persistent_State_$UserName"
# WaveBrowser Preferences
$UserPath = "$($_.FullName)\AppData\Local\WaveBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Preferences" -FolderName "WaveBrowser_Preferences_$UserName"
# WaveBrowser Secure Preferences
$UserPath = "$($_.FullName)\AppData\Local\WaveBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Secure Preferences" -FolderName "WaveBrowser_Secure_Preferences_$UserName"
# WaveBrowser Quota Manager
$UserPath = "$($_.FullName)\AppData\Local\WaveBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "QuotaManager" -FolderName "WaveBrowser_Quota_Manager_$UserName"
# WaveBrowser Reporting and NEL
$UserPath = "$($_.FullName)\AppData\Local\WaveBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Reporting and NEL" -FolderName "WaveBrowser_Reporting_and_NEL_$UserName"
# WaveBrowser Shortcuts
$UserPath = "$($_.FullName)\AppData\Local\WaveBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Shortcuts*" -FolderName "WaveBrowser_Shortcuts_$UserName"
# WaveBrowser Top Sites
$UserPath = "$($_.FullName)\AppData\Local\WaveBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Top Sites*" -FolderName "WaveBrowser_Top_Sites_$UserName"
# WaveBrowser Trust Tokens
$UserPath = "$($_.FullName)\AppData\Local\WaveBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Trust Tokens*" -FolderName "WaveBrowser_Trust_Tokens_$UserName"
# WaveBrowser SyncData Database
$UserPath = "$($_.FullName)\AppData\Local\WaveBrowser\User Data\*\Sync Data"
Collect-Artifact -SourceDir $UserPath -FileMask "SyncData.sqlite3" -FolderName "WaveBrowser_SyncData_Database_$UserName"
# WaveBrowser Visited Links
$UserPath = "$($_.FullName)\AppData\Local\WaveBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Visited Links" -FolderName "WaveBrowser_Visited_Links_$UserName"
# WaveBrowser Web Data
$UserPath = "$($_.FullName)\AppData\Local\WaveBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Web Data*" -FolderName "WaveBrowser_Web_Data_$UserName"
# Windows Protect Folder
$UserPath = "$($_.FullName)\AppData\Roaming\Microsoft\Protect\*"
Collect-Artifact -SourceDir $UserPath -FolderName "Windows_Protect_Folder_$UserName"
# WaveBrowser Snapshots Folder
$UserPath = "$($_.FullName)\AppData\Local\WaveBrowser\User Data\Snapshots\*"
Collect-Artifact -SourceDir $UserPath -FolderName "WaveBrowser_Snapshots_Folder_$UserName"
# Yandex Cookies
$UserPath = "$($_.FullName)\AppData\Local\Yandex\YandexBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Cookies*" -FolderName "Yandex_Cookies_$UserName"
# Yandex Network Persistent State
$UserPath = "$($_.FullName)\AppData\Local\Yandex\YandexBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Network Persistent State" -FolderName "Yandex_Network_Persistent_State_$UserName"
# Yandex Favicons
$UserPath = "$($_.FullName)\AppData\Local\Yandex\YandexBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Favicons*" -FolderName "Yandex_Favicons_$UserName"
# Yandex History
$UserPath = "$($_.FullName)\AppData\Local\Yandex\YandexBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "History*" -FolderName "Yandex_History_$UserName"
# Yandex Sessions Folder
$UserPath = "$($_.FullName)\AppData\Local\Yandex\YandexBrowser\User Data\*\Sessions"
Collect-Artifact -SourceDir $UserPath -FolderName "Yandex_Sessions_Folder_$UserName"
# Yandex Login Data
$UserPath = "$($_.FullName)\AppData\Local\Yandex\YandexBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Ya Passman Data*" -FolderName "Yandex_Login_Data_$UserName"
# Yandex Network Action Predictor
$UserPath = "$($_.FullName)\AppData\Local\Yandex\YandexBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Network Action Predictor" -FolderName "Yandex_Network_Action_Predictor_$UserName"
# Yandex Preferences
$UserPath = "$($_.FullName)\AppData\Local\Yandex\YandexBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Preferences" -FolderName "Yandex_Preferences_$UserName"
# Yandex Top Sites
$UserPath = "$($_.FullName)\AppData\Local\Yandex\YandexBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Top Sites*" -FolderName "Yandex_Top_Sites_$UserName"
# Yandex Bookmarks
$UserPath = "$($_.FullName)\AppData\Local\Yandex\YandexBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Bookmarks*" -FolderName "Yandex_Bookmarks_$UserName"
# Yandex Visited Links
$UserPath = "$($_.FullName)\AppData\Local\Yandex\YandexBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Visited Links" -FolderName "Yandex_Visited_Links_$UserName"
# Yandex Web Data
$UserPath = "$($_.FullName)\AppData\Local\Yandex\YandexBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Web Data*" -FolderName "Yandex_Web_Data_$UserName"
# Yandex Autofill data
$UserPath = "$($_.FullName)\AppData\Local\Yandex\YandexBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Ya Autofill Data*" -FolderName "Yandex_Autofill_data_$UserName"
# Yandex Passman logs
$UserPath = "$($_.FullName)\AppData\Local\Yandex\YandexBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Passman Logs*" -FolderName "Yandex_Passman_logs_$UserName"
# Yandex Shortcuts
$UserPath = "$($_.FullName)\AppData\Local\Yandex\YandexBrowser\User Data\*"
Collect-Artifact -SourceDir $UserPath -FileMask "Shortcuts*" -FolderName "Yandex_Shortcuts_$UserName"
}
Write-Host ("Collection complete. Copied: {0} Missed: {1} Errors: {2}" -f $Summary.Copied, $Summary.Missed, $Summary.Errors) -ForegroundColor Green› Save as .ps1 and run as Administrator. Use: powershell -ExecutionPolicy Bypass -File script.ps1
Note: This is a compound target that references 25 other targets. The KAPE command resolves them natively; the PowerShell/Batch/WSL scripts flatten every referenced path into explicit copy commands.
› cyberchef recipes
Open in CyberChef to decode values extracted from this artifact.
notes
For those looking to contribute to this list, check here for ideas: https://en.wikipedia.org/wiki/Comparison_of_web_browsers.
Install one of the applications not covered above and find where useful information is stored. If useful information can be located, make an individual Target for it and place in the appropriate folder. Then, include that Target in the appropriate Compound Target.