winDECK/winDECK_Module_CollectData.ps1 at master · StefanKubsch/winDECK · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
# winDECK - Windows Digital Evidence Collection Kit
#
# winDECK_Module_CollectData.ps1
#
# Collect Data Module
#
# v1.0
#
# 29.08.2017
#
# (C) Stefan Kubsch
#
# https://github.com/StefanKubsch/winDECK
#

Set-StrictMode -Version "Latest"

$localScriptRoot = $PSScriptRoot

#region Include Functions Library
. "$localScriptRoot\Resources\Libs\General.ps1"
. "$localScriptRoot\Resources\Libs\CDM.ps1"
#endregion

#region Initialize environment
ShowSplashScreen ($CDMSplashScreen)
Header_InitializeEnvironment
CheckForPSVersion ($CDMMinPSVersion)
CheckForAdminRights
CheckForOSVersion(10)
CheckFreeSpace ($CDMOutputDrive)
CheckWriteAccess ($localScriptRoot)
CreateResultsFolder ($CDMResultsFolder)
StartLogging ($CDMResultsFolder)
#endregion

#region Data Collection
Write-Host ""
Write-Host -BackgroundColor Red "Running data collection..."
Write-Host ""

#region OS
CDM_CheckDomainJoin
CDM_GatherBasicOSInfo
#endregion

#region Networking
CDM_GatherIPConfig
CDM_GatherTCPConnections
CDM_GatherNetRoute
CDM_GatherDNSClientCache
CDM_GatherARPCache
CDM_GatherHostsFile
#endregion

#region Filesystem
CDM_GatheringModifiedFiles
CDM_GatherPrefetchFiles
#endregion

#region Processes
CDM_GatherStartupProcesses
CDM_GatherRunningProcesses
#endregion

#region Services
CDM_GatherServices
#endregion

#region Tasks
CDM_GatherScheduledTasks
#endregion

#region Security
CDM_GatherSIDS
CDM_GatherLocalAdministrators
CDM_GatherLogons
CDM_GatherFirewallStatus
CDM_GatherAntiVirusSolution
CDM_GatherMSAntimalwareStatus
CDM_GatherMSAntimalwareThreatHistory
CDM_GatherCredentialGuardStatus
CDM_GatherUEFISecureBootStatus
CDM_GatherUACStatus
CDM_GetBitlockerStatus
#endregion

#region Software
CDM_GatherInstalledApplications
#endregion

#region Updates
CDM_GatherInstalledUpdates
#endregion

#region EventLogs
CDM_ExportEventLogs
#endregion

#region GPO
CDM_GatherGPOResultingSet
#endregion

#region Hardware
#CDM_GatheringConnectedDevices
CDM_GatheringUSBFlashDriveHistory
#endregion

#region Browser
CDM_GatherIEHistory
CDM_GatherChromeHistory
CDM_GatherFirefoxHistory
#endregion

#endregion

#region Security tasks
Header_Security
StopLogging
Set-ItemProperty -Path $CDMResultsFolder\$Hostname"_Hashes.txt" -Name IsReadOnly -Value $True
#endregion

#region Exit winDECK
Header_PreparingExit
#endregion