diff --git a/Forensicator.ps1 b/Forensicator.ps1 new file mode 100644 index 0000000..4e92a43 --- /dev/null +++ b/Forensicator.ps1 @@ -0,0 +1,1817 @@ +# Live Forensicator Powershell Script +# Part of the Black Widow Tools +# Coded by Ebuka John Onyejegbu + + + +[cmdletbinding()] +param( + + + [String]$LOG4J, + [String]$RAM, + [String]$EVTX, + [String]$OPERATOR, + [String]$CASE, + [String]$TITLE, + [String]$LOCATION, + [String]$DEVICE, + [String]$RANSOMWARE, + [String]$WEBLOGS, + [String]$BROWSER, + [String]$PCAP, + [String]$ENCRYPTED, + [switch]$UPDATE, + [switch]$VERSION, + [switch]$DECRYPT, + [switch]$USAGE +) + + +$ErrorActionPreference= 'silentlycontinue' + +################################################## +#region Versioning & Update # +################################################## +$version_file = $PSScriptRoot + "\" + "Updated" + "\" + "version.txt" +$current_version = $PSScriptRoot + "\" + "version.txt" + +$MyVersion = Get-Content -Path .\version.txt + +if ($VERSION.IsPresent) { + Write-Host -Fore Cyan "[!] You are currently running" $MyVersion + Write-Host '' + exit 0 +} + + +if ($UPDATE) { + Write-Host -Fore DarkCyan "[*] Downloading & Comparing Version Files" + New-Item -Name "Updated" -ItemType "directory" -Force | Out-Null + Set-Location Updated + + $source = 'https://raw.githubusercontent.com/Johnng007/Live-Forensicator/main/version.txt' + + $destination = 'version.txt' + +if (((Test-NetConnection www.githubusercontent.com -Port 80 -InformationLevel "Detailed").TcpTestSucceeded) -eq $true) { + + Invoke-WebRequest -Uri $source -OutFile $destination +} + +else { + Write-Host -Fore DarkCyan "[*] githubusercontent.com is not reacheable, please check your connection" + cd $PSScriptRoot + Remove-Item 'Updated' -Force -Recurse + exit 0 +} + +if((Get-FileHash $version_file).hash -eq (Get-FileHash $current_version).hash) { + + Write-Host -Fore Cyan "[*] Congratualtion you have the current version" + cd $PSScriptRoot + Remove-Item 'Updated' -Force -Recurse + exit + } + +else { + Write-Host -Fore DarkCyan "[!] You have an outdated version, we are sorting that out..." + $source = 'https://github.com/Johnng007/Live-Forensicator/archive/refs/heads/main.zip' + $destination = 'Live-Forensicator-main.zip' + Invoke-WebRequest -Uri $source -OutFile $destination + Write-Host -Fore DarkCyan "[*] Extracting the downloads....." + Expand-Archive -Force $PSScriptRoot\Updated\Live-Forensicator-main.zip -DestinationPath $PSScriptRoot\Updated + Write-Host -Fore DarkCyan "[*] Cleaning Up...." + Remove-Item -Path $PSScriptRoot\Updated\Live-Forensicator-main.zip -Force + Remove-Item -Path $PSScriptRoot\Updated\version.txt -Force + Write-Host -Fore Cyan "[*] All Done Enjoy the new version in the Updated Folder" + cd $PSScriptRoot + exit 0 + } +} + + +################################################## +#endregion Versioning & Update # +################################################## + +################################################## +#region ARTIFACT DECRYPTION SWITCH # +################################################## + +if ($DECRYPT) { + + $DecryptPath = $PSScriptRoot + "\" + "$env:computername" + "\" + +if (!(gci $DecryptPath *.forensicator)) { + + Write-Host -Fore DarkCyan "[!] Cannot find encrypted file, Did you relocate it?" + $TargetPath = Read-Host -Prompt 'Enter Path to the Encrypted File' +} +else { + + $TargetPath = $PSScriptRoot + "\" + "$env:computername" + "\" +} + + +# Import FileCryptography module +Import-Module "$PSScriptRoot\Forensicator-Share\FileCryptography.psm1" + +$key = Read-Host -Prompt 'Enter Decryption Key' +$Extension = ".forensicator" + +# Gather all files from the target path and its subdirectories + $FilestoDecrypt = get-childitem -path $TargetPath\* -Include *$Extension -Recurse -force | where { ! $_.PSIsContainer } + + # Decrypt the files + foreach ($file in $FilestoDecrypt) + { + Write-Host "Decrypting $file" + Unprotect-File $file -Algorithm AES -KeyAsPlainText $key -Suffix $Extension -RemoveSource + } + exit 0 +}else{ + +} + +################################################## +#endregion ARTIFACT DECRYPTION SWITCH # +################################################## + +################################################## +#region USAGE # +################################################## + +if ($USAGE) { + + Write-Host '' + Write-Host -Fore DarkCyan 'FORESNSICATOR USAGE' + Write-Host '' + Write-Host -Fore DarkCyan '[*] .\Forensicator.ps1 This runs the Basic checks on a system.' + Write-Host '' + Write-Host -Fore DarkCyan 'FLAGS' + Write-Host -Fore Cyan 'The below flags can be added to the Basic Usage' + Write-Host '' + Write-Host -Fore DarkCyan '[*] -EVTX EVTX Also grab Event Logs' + Write-Host -Fore DarkCyan '[*] -WEBLOGS WEBLOGS Also grab Web Logs.' + Write-Host -Fore DarkCyan '[*] -PCAP PCAP Run network tracing and capture PCAP for 120seconds' + Write-Host -Fore Cyan "[!] requires the etl2pcapng file in share folder" + Write-Host -Fore DarkCyan '[*] -RAM RAM Extract RAM Dump' + Write-Host -Fore Cyan "[!] requires the winpmem file in share folder" + Write-Host -Fore DarkCyan '[*] -LOG4J LOG4J Checks for vulnerable log4j files' + Write-Host -Fore DarkCyan '[*] -ENCRYPTED ENCRYPTED Encrypt Artifacts after collecting them' + Write-Host -Fore Cyan "[!] requires the FileCryptography file in share folder" + Write-Host -Fore DarkCyan '[*] -BROWSER BROWSER Grabs a detailed browsing history from system' + Write-Host -Fore Cyan "[!] requires the Nirsoft BrowserView file in share folder" + Write-Host -Fore DarkCyan '' + Write-Host -Fore DarkCyan 'SWITCHES' + Write-Host -Fore DarkCyan '' + Write-Host -Fore DarkCyan '[*] .\Forensicator.ps1 -VERSION This checks the version of Foresicator you have' + Write-Host -Fore DarkCyan '[*] .\Forensicator.ps1 -UPDATE This checks for and updates your copy of Forensicator' + Write-Host -Fore DarkCyan '[*] .\Forensicator.ps1 -DECRYPT DECRYPT This decrypts a Foresicator encrypted Artifact' + Write-Host -Fore Cyan "[!] requires the FileCryptography file in share folder" + Write-Host -Fore DarkCyan '[*] .\Forensicator.ps1 -USAGE Prints this help file' + + exit 0 +}else{ + +} + +################################################## +#endregion ARTIFACT DECRYPTION SWITCH # +################################################## + +$ErrorActionPreference= 'silentlycontinue' + +$t = @" + +___________ .__ __ +\_ _____/__________ ____ ____ _____|__| ____ _____ _/ |_ ___________ + | __)/ _ \_ __ \_/ __ \ / \ / ___/ |/ ___\\__ \\ __\/ _ \_ __ \ + | \( <_> ) | \/\ ___/| | \\___ \| \ \___ / __ \| | ( <_> ) | \/ + \___ / \____/|__| \___ >___| /____ >__|\___ >____ /__| \____/|__| + \/ \/ \/ \/ \/ \/ + + $MyVersion + +"@ + +for ($i=0;$i -lt $t.length;$i++) { +if ($i%2) { + $c = "red" +} +elseif ($i%5) { + $c = "yellow" +} +elseif ($i%7) { + $c = "green" +} +else { + $c = "white" +} +write-host $t[$i] -NoNewline -ForegroundColor $c +} + +################################################## +#region Check if the share folder exists # +################################################## +Write-Host '' + +$Folder = 'Forensicator-Share' + +if (Test-Path -Path $Folder) { + #Write-Host -Fore Cyan "[!] You have the share folder moving on.." +} else { + Write-Host -Fore Cyan "[!] Forensicator-Share folder not found, some flags will not work, use the -UPDATE flag to import the complete Arsenal.." + Write-Host -Fore Cyan "[!] Moving on...." +} + + +################################################## +#endregion Check if the share folder exists # +################################################## + +Write-Host '' +Write-Host '' +Write-Host '' +Write-Host -Fore DarkCyan '[!] Live Forensicator' +Write-Host '' +Write-Host -Fore DarkCyan '[!] Examines the host for suspicious activities and grabs required data for further forensics.' +Write-Host -Fore DarkCyan '[!] By Ebuka John Onyejegbu.' +Write-Host -Fore DarkCyan '[!] https://github.com/Johnng007/Live-Forensicator' +Write-Host -Fore DarkCyan '[!] https://john.ng' +Write-Host '' +Write-Host '' +Write-Host '' + +####################################################################### +#region PARAMETER SETTINGS ########################################### +####################################################################### + +#FOR OPERATOR + +if ($OPERATOR) { + + $Handler = $OPERATOR + +} +else { + + $Handler = Read-Host -Prompt 'Enter Investigator Name' + +} + +#FOR CASE REFERENCE +if ($CASE) { + + $CASENO = $CASE + +} +else { + + $CASENO = Read-Host -Prompt 'Enter Case Reference' + +} + +#EXHIBIT REFERENCE +if ($TITLE) { + + $Ref = $TITLE + +} +else { + + $Ref = Read-Host -Prompt 'Enter Investigation Title' + +} + +#LOCATION +if ($LOCATION) { + + $Loc = $LOCATION + +} +else { + + $Loc = Read-Host -Prompt 'Enter examination location' + +} + +#DESCRIPTION +if ($DEVICE) { + + $Des = $DEVICE + +} +else { + + $Des = Read-Host -Prompt 'Enter description of device e.g. "Asus Laptop"' + +} + +####################################################################### +#endregion END PARAMETER SETTINGS ##################################### +####################################################################### + +Write-Host '' +Write-Host '' +Write-Host '' + +$DateFormat = "yyyy'-'MM'-'dd HH':'mm':'ss" + +$StartTime = Get-Date -Format $DateFormat + +# creating a directory to store the artifacts of this host +mkdir $env:computername -Force | Out-Null + +# Moving to the new folder +Set-Location $env:computername + + +# Setting index output file +$FinalDes = 'index.html' + +# Setting Network Information Output +$NetDes = 'network.html' + +# Setting Users Information Output +$UserDes = 'users.html' + +# Setting System Information Output +$SysDes = 'system.html' + +# Setting Processes Output +$ProcDes = 'processes.html' + +# Setting Other Checks Output +$OtherDes = 'others.html' + +Write-Host -Fore DarkCyan "[*] Gathering Network & Network Settings" + +################################################## +#region Network Information and Settings # +################################################## + +#Gets DNS cache. Replaces ipconfig /dislaydns + +$DNSCache = Get-DnsClientCache | select Entry,Name, Status, TimeToLive, Data | ConvertTo-Html -fragment + +$NetworkAdapter = Get-WmiObject -class Win32_NetworkAdapter | Select-Object -Property AdapterType,ProductName,Description,MACAddress,Availability,NetconnectionStatus,NetEnabled,PhysicalAdapter | ConvertTo-Html -Fragment + +#Replaces ipconfig: + +$IPConfiguration = Get-WmiObject Win32_NetworkAdapterConfiguration | select Description, @{Name='IpAddress';Expression={$_.IpAddress -join '; '}}, @{Name='IpSubnet';Expression={$_.IpSubnet -join '; '}}, MACAddress, @{Name='DefaultIPGateway';Expression={$_.DefaultIPGateway -join '; '}}, DNSDomain, DNSHostName, DHCPEnabled, ServiceName | convertTo-Html -fragment +$NetIPAddress = Get-NetIPaddress | select InterfaceAlias, IPaddress, EnabledState, OperatingStatus | ConvertTo-Html -fragment +$NetConnectProfile = Get-NetConnectionProfile | select Name, InterfaceAlias, NetworkCategory, IPV4Connectivity, IPv6Connectivity | ConvertTo-Html -fragment +$NetAdapter = Get-NetAdapter | select Name, InterfaceDescription, Status, MacAddress, LinkSpeed | ConvertTo-Html -fragment + +#Replaces arp -a: + +$NetNeighbor = Get-NetNeighbor | select InterfaceAlias, IPAddress, LinkLayerAddress | ConvertTo-Html -fragment + +#Replaces netstat commands + +$NetTCPConnect = Get-NetTCPConnection | Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort, State, OwningProcess, @{Name="Process";Expression={(Get-Process -Id $_.OwningProcess).ProcessName}}| ConvertTo-Html -Fragment + + +#Get Wi-fi Names and Passwords + +$WlanPasswords = netsh.exe wlan show profiles | Select-String "\:(.+)$" | %{$wlanname=$_.Matches.Groups[1].Value.Trim(); $_} | %{(netsh wlan show profile name="$wlanname" key=clear)} | Select-String 'Key Content\W+\:(.+)$' | %{$wlanpass=$_.Matches.Groups[1].Value.Trim(); $_} | %{[PSCustomObject]@{ PROFILE_NAME=$wlanname;PASSWORD=$wlanpass }} | ConvertTo-Html -fragment + +#Get Firewall Information. Replaces netsh firewall show config + +$FirewallRule = Get-NetFirewallRule | select-object Name, DisplayName, Description, Direction, Action, EdgeTraversalPolicy, Owner, EnforcementStatus | ConvertTo-Html -fragment + +#Display active samba sessions + +$SMBSessions = Get-SMBSession -ea silentlycontinue | convertTo-Html -fragment + + +#Display active samba shares + +$SMBShares = Get-SMBShare | select description, path, volume | convertTo-Html -fragment + +#Get IP routes to non-local destinations + +$NetHops = Get-NetRoute | Where-Object -FilterScript { $_.NextHop -Ne "::" } | Where-Object -FilterScript { $_.NextHop -Ne "0.0.0.0" } | Where-Object -FilterScript { ($_.NextHop.SubString(0,6) -Ne "fe80::") } | convertTo-Html -fragment + +#Get network adapters that have IP routes to non-local destinations + +$AdaptHops = Get-NetRoute | Where-Object -FilterScript {$_.NextHop -Ne "::"} | Where-Object -FilterScript { $_.NextHop -Ne "0.0.0.0" } | Where-Object -FilterScript { ($_.NextHop.SubString(0,6) -Ne "fe80::") } | Get-NetAdapter | convertTo-Html -fragment + +#Get IP routes that have an infinite valid lifetime + +$IpHops = Get-NetRoute | Where-Object -FilterScript { $_.ValidLifetime -Eq ([TimeSpan]::MaxValue) } | convertTo-Html -fragment + +Write-Host -Fore Cyan "[!] Done" + +#endregion + + +################################################## +#region User & Account Information # +################################################## + +Write-Host -Fore DarkCyan "[*] Gathering User & Account Information" + + +$currentuser = Get-WMIObject -class Win32_ComputerSystem | select username | ConvertTo-Html -Fragment +$systemname = Get-WmiObject -Class Win32_ComputerSystem | select Name, DNSHostName, Domain, Manufacturer, Model, PrimaryOwnerName, TotalPhysicalMemory, Workgroup | ConvertTo-Html -Fragment +#$useraccounts = Get-WmiObject -Class Win32_UserAccount | Select-Object -Property AccountType,Domain,LocalAccount,Name,PasswordRequired,SID,SIDType | ConvertTo-Html -fragment +$logonsession = Get-WmiObject -Class Win32_LogonSession | Select-Object -Property LogonID,LogonType,StartTime, @{Name='Start Time';Expression={$_.ConvertToDateTime($_.starttime)}} | ConvertTo-Html -fragment +#######ADDITIONS +$logonsession = query user | ConvertTo-Html -Fragment +$userprocesses = Get-Process -includeusername | ConvertTo-Html -fragment +$userprofiles = Get-WmiObject -Class Win32_UserProfile | Select-object -property Caption, LocalPath, SID, @{Name='Last Used';Expression={$_.ConvertToDateTime($_.lastusetime)}} | ConvertTo-Html -Fragment + +$administrators = Get-LocalGroupMember -Group "Administrators" | ConvertTo-Html -Fragment + +$LocalGroup = Get-LocalGroup | ConvertTo-Html -Fragment + +Write-Host -Fore Cyan "[!] Done" + +#endregion + + +################################################## +#region Installed Programs # +################################################## + +Write-Host -Fore DarkCyan "[*] Gathering Installed Programs" + +$InstProgs = Get-CimInstance -ClassName win32_product | Select-Object Name, Version, Vendor, InstallDate, InstallSource, PackageName, LocalPackage | ConvertTo-Html -Fragment + +$InstalledApps = Get-ItemProperty HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName, DisplayVersion, Publisher, InstallDate | ConvertTo-Html -Fragment + +Write-Host -Fore Cyan "[!] Done" + +#endregion + + +################################################## +#region System Info # +################################################## + +Write-Host -Fore DarkCyan "[*] Gathering System Information" + +#Environment Settings +$env = Get-ChildItem ENV: | select name, value | convertto-html -fragment + +#System Info +$systeminfo = Get-WmiObject -Class Win32_ComputerSystem | Select-Object -Property Name,Caption,SystemType,Manufacturer,Model,DNSHostName,Domain,PartOfDomain,WorkGroup,CurrentTimeZone,PCSystemType,HyperVisorPresent | ConvertTo-Html -Fragment + +#OS Info +$OSinfo = Get-WmiObject -Class Win32_OperatingSystem | Select-Object -Property Name, Description,Version,BuildNumber,InstallDate,SystemDrive,SystemDevice,WindowsDirectory,LastBootupTime,Locale,LocalDateTime,NumberofUsers,RegisteredUser,Organization,OSProductSuite | ConvertTo-Html -Fragment + +#Hotfixes +$Hotfixes = Get-Hotfix | Select-Object -Property CSName, Caption,Description, HotfixID, InstalledBy, InstalledOn | ConvertTo-Html -fragment + + +#Get Windows Defender Status +$WinDefender = Get-MpComputerStatus | convertto-html -fragment + +Write-Host -Fore Cyan "[!] Done" + +#endregion + + +################################################## +#region Live Running Processes & Scheduled Tasks # +################################################## + +Write-Host -Fore DarkCyan "[*] Gathering Processes and Tasks" + + +$Processes = Get-Process | Select Handles, StartTime, PM, VM, SI, id, ProcessName, Path, Product, FileVersion | ConvertTo-Html -Fragment + +#Items set to run on startup + +$StartupProgs = Get-WmiObject Win32_StartupCommand | select Command, User, Caption | ConvertTo-Html -fragment + +# Scheduled Tasks +$ScheduledTask = Get-ScheduledTask | ? State -eq running | ConvertTo-Html -Fragment + +# Get Running Tasks and Their state +$ScheduledTask2 = Get-ScheduledTask | ? State -eq running | Get-ScheduledTaskInfo | ConvertTo-Html -Fragment + +#Services +$Services = Get-Service | Select-Object Name, DisplayName, Status, StartType | ConvertTo-Html -Fragment + +Write-Host -Fore Cyan "[!] Done" + +#endregion + + +################################################## +#region Settings from the Registry # +################################################## + +Write-Host -Fore DarkCyan "[*] Checking Registry for persistance" + +$RegRun = Get-ItemProperty -Path HKLM:\Software\Microsoft\Windows\CurrentVersion\Run | ConvertTo-Html -Fragment + +$RegRunOnce = Get-ItemProperty -Path HKLM:\Software\Microsoft\Windows\CurrentVersion\RunOnce | ConvertTo-Html -Fragment + +$RegRunOnceEx = Get-ItemProperty -Path HKLM:\Software\Microsoft\Windows\CurrentVersion\RunOnceEx | ConvertTo-Html -Fragment + +Write-Host -Fore Cyan "[!] Done" + +#endregion + + +################################################## +#region Checking other worthwhiles # +################################################## + +Write-Host -Fore DarkCyan "[*] Running Other Final Checks..." + +#Logical drives (current session) +$LogicalDrives = get-wmiobject win32_logicaldisk | select DeviceID, DriveType, FreeSpace, Size, VolumeName | ConvertTo-Html -fragment + + +#Gets list of USB devices + +$USBDevices = Get-ItemProperty -Path HKLM:\System\CurrentControlSet\Enum\USB*\*\* | select FriendlyName, Driver, mfg, DeviceDesc | ConvertTo-Html -fragment + +#Identifies any connected/previously connected webcams +#$Imagedevice = Get-PnpDevice -class 'image' -EA SilentlyContinue | ConvertTo-Html -Fragment +$Imagedevice = Get-WmiObject Win32_PnPEntity | where {$_.caption -match 'camera'} -EA SilentlyContinue | where caption -match 'camera' | ConvertTo-Html -Fragment + +#All currently connected PNP devices +$UPNPDevices = Get-PnpDevice -PresentOnly -class 'USB', 'DiskDrive', 'Mouse', 'Keyboard', 'Net', 'Image', 'Media', 'Monitor' | ConvertTo-Html -Fragment + +#All previously connected disk drives not currently accounted for. Useful if target computer has had drive replaced/hidden +$UnknownDrives = Get-ItemProperty -Path HKLM:\SYSTEM\CurrentControlSet\Enum\USBSTOR\*\* | Select FriendlyName | ConvertTo-Html -Fragment + +#Gets all link files created in last 180 days. Perhaps export this as a separate CSV and make it keyword searchable? + +$LinkFiles = Get-WmiObject Win32_ShortcutFile | select Filename, Caption, @{NAME='CreationDate';Expression={$_.ConvertToDateTime($_.CreationDate)}}, @{Name='LastAccessed';Expression={$_.ConvertToDateTime($_.LastAccessed)}}, @{Name='LastModified';Expression={$_.ConvertToDateTime($_.LastModified)}}, Target | Where-Object {$_.LastModified -gt ((Get-Date).AddDays(-180)) } | sort LastModified -Descending | ConvertTo-Html -Fragment + +#Gets last 100 days worth of Powershell History + +$PSHistory = Get-History -count 500 | select id, commandline, startexecutiontime, endexecutiontime | ConvertTo-Html -fragment + + +#All items in Downloads folder. This may cause an error if the script is run from an external USB or Network drive, even when +$Downloads = Get-ChildItem C:\Users\*\Downloads\* -recurse | select PSChildName, Root, Name, FullName, Extension, CreationTimeUTC, LastAccessTimeUTC, LastWriteTimeUTC, Attributes | where {$_.extension -eq '.exe'} | ConvertTo-Html -Fragment + +#Executables Running From Obscure Places +$HiddenExecs1 = Get-ChildItem C:\Users\*\AppData\Local\Temp\* -recurse | select PSChildName, Root, Name, FullName, Extension, CreationTimeUTC, LastAccessTimeUTC, LastWriteTimeUTC, Attributes | where {$_.extension -eq '.exe'} | ConvertTo-Html -Fragment +$HiddenExecs2 = Get-ChildItem C:\Temp\* -recurse | select PSChildName, Root, Name, FullName, Extension, CreationTimeUTC, LastAccessTimeUTC, LastWriteTimeUTC, Attributes | where {$_.extension -eq '.exe'} | ConvertTo-Html -Fragment +$HiddenExecs3 = Get-ChildItem C:\PerfLogs\* -recurse | select PSChildName, Root, Name, FullName, Extension, CreationTimeUTC, LastAccessTimeUTC, LastWriteTimeUTC, Attributes | where {$_.extension -eq '.exe'} | ConvertTo-Html -Fragment +$HiddenExecs4 = Get-ChildItem C:\Users\*\Documents\* -recurse | select PSChildName, Root, Name, FullName, Extension, CreationTimeUTC, LastAccessTimeUTC, LastWriteTimeUTC, Attributes | where {$_.extension -eq '.exe'} | ConvertTo-Html -Fragment + + + + +#End time date stamp + +$EndTime = Get-Date -Format $DateFormat + + +#endregion + + +########################################################################################################### +#region ########################## CREATING AND FORMATTING THE HTML FILES ################################ +########################################################################################################### + +Write-Host -Fore DarkCyan "[*] Creating and Formatting our Index file" + + +# Setting Head for the index file +ConvertTo-Html -Head $head -Title "Live Forensic Output For $env:computername" >$FinalDes + +# Setting up index style +$head = '' + +$head >> $FinalDes + + +# Making the Menus for Index File + +$IndexNav = "' + + + + + +'" + +$BlackWidow =' +
+ +
' + +$BlackWidowStyle = ' +' + +$BlackWidowStyle >> $FinalDes +$BlackWidow >> $FinalDes +$IndexNav >> $FinalDes + +'

' >> $FinalDes + +# Setting Body content for index file. +echo "

Live Forensics Result for $env:computername

" | Out-File -Append $FinalDes + +'

' >> $FinalDes + +#Case information + +echo "

Case reference: $CASENO


" | Out-File -Append $FinalDes + +echo "

Examiner Name: $Handler


" | Out-File -Append $FinalDes + +echo "

Exhibit reference: $Ref

" | Out-File -Append $FinalDes + +echo "

Device: $Des


" | Out-File -Append $FinalDes + +echo "

Examination Location: $Loc


" | Out-File -Append $FinalDes + +echo "

Start Time and Date: $StartTime


" | Out-File -Append $FinalDes +echo "

End Time and Date: $EndTime


" | Out-File -Append $FinalDes + +'

' >> $FinalDes +'

' >> $FinalDes + +#endregion + +########################################################################################################### +#region ####### VIEW USER GP RESULTS ################################################################## +########################################################################################################### +# get GPO REsult if on domain + +if ((gwmi win32_computersystem).partofdomain -eq $true) { + + Write-Host -Fore DarkCyan "[*] Collecting GPO Results" + $GP = GPRESULT /H GPOReport.html /F + echo "

Group Policy Report

View the GPO report

" | Out-File -Append $FinalDes + Write-Host -Fore Cyan "[!] Done" +} else { + Write-Host -Fore Cyan "[!] Computer is not on the domain...moving on" +} + + + +#endregion + + +########################################################################################################### +#region MEMORY (RAM) CAPTURE ########################################################################## +########################################################################################################### + + +if ($RAM) { + # capture the RAM + mkdir RAM | Out-Null + Write-Host -Fore DarkCyan "[*] Capturing The RAM" + +if ((gwmi win32_operatingsystem | select osarchitecture).osarchitecture -eq "64-bit"){ + +& $PSScriptRoot\Forensicator-Share\winpmem_mini_x64_rc2.exe RAM\$env:computername.raw | Out-Null + + Write-Host -Fore Cyan "[!] Done" + + echo "

WINPMEM RAM CAPTURE:

View RAM Capture

" | Out-File -Append $FinalDes + +} +else{ + +& $PSScriptRoot\Forensicator-Share\winpmem_mini_x86.exe RAM\$env:computername.raw | Out-Null + + Write-Host -Fore Cyan "[!] Done" + + echo "

WINPMEM RAM CAPTURE:

View RAM Capture

" | Out-File -Append $FinalDes +} + + +} +else { + +} + +#endregion + + + +if ($BROWSER) { + +########################################################################################################### +#region BROWSER NIRSOFT ################################################################### +########################################################################################################### + + Write-Host -Fore DarkCyan "[*] Extracting Browser History" + + #GETTING BROWSING History +if ((gwmi win32_operatingsystem | select osarchitecture).osarchitecture -eq "64-bit"){ + +& $PSScriptRoot\Forensicator-Share\BrowsingHistoryView64.exe /sverhtml "BrowserHistory.html" /SaveDirect /HistorySource 1 /VisitTimeFilterType 1 /LoadIE 1 /LoadFirefox 1 /LoadChrome 1 /LoadSafari 1 + echo "

BROWSING HISTORY:

View Browsing History

" | Out-File -Append $FinalDes + + +} +else{ + +& $PSScriptRoot\Forensicator-Share\BrowsingHistoryView86.exe /sverhtml "BrowserHistory.html" /SaveDirect /HistorySource 1 /VisitTimeFilterType 1 /LoadIE 1 /LoadFirefox 1 /LoadChrome 1 /LoadSafari 1 + + echo "

BROWSING HISTORY:

View Browsing History

" | Out-File -Append $FinalDes +} + +#Lets wait a while for this to finish +Start-Sleep -s 15 + +Write-Host -Fore Cyan "[!] Done" + +########################################################################################################### +#endregion BROWSER NIRSOFT ################################################################### +########################################################################################################### + +} +else { + +########################################################################################################### +#region BROWSER INBUILT ########################################################################## +########################################################################################################### + + Write-Host -Fore DarkCyan "[*] Extracting Browser History (Inbuilt)" + + + #CHROME + +mkdir BROWSING_HISTORY | Out-Null + +$users = Get-ChildItem $Env:SystemDrive\Users|where{$_.name -notmatch 'Public|default'} +foreach ($user in $users){ + + $Path = "$($user.fullname)\AppData\Local\Google\Chrome\User Data\Default\History" + if (-not (Test-Path -Path $Path)) { + Write-Verbose "[!] Could not find Chrome History for username: $user" + } + $Regex = '(http|https)://([\w-]+\.)+[\w-]+(/[\w- ./?%&=]*)*?' + $Value = Get-Content -Path $path | Select-String -AllMatches $regex |% {($_.Matches).Value} |Sort -Unique + $Value | ForEach-Object { + $Key = $_ + if ($Key -match $Search){ + + New-Object -TypeName PSObject -Property @{ + User = $user + Browser = 'Chrome' + DataType = 'History' + Data = $_ + } + + } + } | Out-File BROWSING_HISTORY\Chrome_History_of_$user.txt + +} + +#MOZILLA + +$users = Get-ChildItem $Env:SystemDrive\Users|where{$_.name -notmatch 'Public|default'} +foreach ($user in $users){ + + $Path = "$($user.fullname)\AppData\Roaming\Mozilla\Firefox\Profiles\" + if (-not (Test-Path -Path $Path)) { + Write-Verbose "[!] Could not find Chrome History for username: $user" + } + $Profiles = Get-ChildItem -Path "$Path\*.default\" -ErrorAction SilentlyContinue + $Regex = '(http|https)://([\w-]+\.)+[\w-]+(/[\w- ./?%&=]*)*?' + $Value = Get-Content $Profiles\places.sqlite | Select-String -AllMatches $regex |% {($_.Matches).Value} |Sort -Unique + $Value | ForEach-Object { + $Key = $_ + if ($Key -match $Search){ + + New-Object -TypeName PSObject -Property @{ + User = $user + Browser = 'Firefox' + DataType = 'History' + Data = $_ + } + + } + } | Out-File BROWSING_HISTORY\Firefox_History_of_$user.txt + +} + +#IE + + + +$Null = New-PSDrive -Name HKU -PSProvider Registry -Root HKEY_USERS + $Paths = Get-ChildItem 'HKU:\' -ErrorAction SilentlyContinue | Where-Object { $_.Name -match 'S-1-5-21-[0-9]+-[0-9]+-[0-9]+-[0-9]+$' } + + ForEach($Path in $Paths) { + + $User = ([System.Security.Principal.SecurityIdentifier] $Path.PSChildName).Translate( [System.Security.Principal.NTAccount]) | Select -ExpandProperty Value + + $Path = $Path | Select-Object -ExpandProperty PSPath + + $UserPath = "$Path\Software\Microsoft\Internet Explorer\TypedURLs" + if (-not (Test-Path -Path $UserPath)) { + Write-Verbose "[!] Could not find IE History for SID: $Path" + } + else { + Get-Item -Path $UserPath -ErrorAction SilentlyContinue | ForEach-Object { + $Key = $_ + $Key.GetValueNames() | ForEach-Object { + $Value = $Key.GetValue($_) + if ($Value -match $Search) { + New-Object -TypeName PSObject -Property @{ + User = $_.Name + Browser = 'IE' + DataType = 'History' + Data = $Value + } + } + } + } | Out-File BROWSING_HISTORY\IE_History.txt + } + } + + +echo "

BROWSING HISTORY:

View Browsing History

" | Out-File -Append $FinalDes + +Write-Host -Fore Cyan "[!] Done" +########################################################################################################### +#endregion BROWSER INBUILT ############################################################### +########################################################################################################### + +} + + + + +########################################################################################################### +#region CHECKING FOR RANSOMWARE ENCRYPTED FILES ####################################################### +########################################################################################################### + +if ($RANSOMWARE) { + + Write-Host -Fore DarkCyan "[*] Checking For Ransomware Encrypted Files" + Write-Host -Fore DarkCyan "[!] NOTE: This May Take a While Depending on the Number of Drives" + +#CHECKING FOR RANSOMWARE ENCRYPTED FILES + + $Drives = Get-PSDrive -PSProvider 'FileSystem' + +foreach($Drive in $drives) { + + $FindFiles = Get-ChildItem -Path $Drive.Root -Include *._AiraCropEncrypted,*.1cbu1,*.1txt,*.73i87A,*.a5zfn,*.aaa,*.abc,*.adk,*.aesir,*.alcatraz,*.angelamerkel,*.AngleWare,*.antihacker2017,*.atlas,*.axx,*.BarRax,*.bitstak,*.braincrypt,*.breaking_bad,*.bript,*.btc,*.ccc,*.CCCRRRPPP,*.cerber,*.cerber2,*.cerber3,*.coded,*.comrade,*.conficker,*.coverton,*.crab,*.crinf,*.crjoker,*.crptrgr,*.cry,*.cryeye,*.cryp1,*.crypt,*.crypte,*.crypted,*.cryptolocker,*.cryptowall,*.crypz,*.czvxce,*.d4nk,*.dale,*.damage,*.darkness,*.dCrypt,*.decrypt2017,*.Dexter,*.dharma,*.dxxd,*.ecc,*.edgel,*.enc,*.enc,*.enciphered,*.EnCiPhErEd,*.encr,*.encrypt,*.encrypted,*.encrypted,*.encrypted,*.enigma,*.evillock,*.exotic,*.exx,*.ezz,*.fantom,*.file0locked,*.fucked,*.fun,*.fun,*.gefickt,*.globe,*.good,*.grt,*.ha3,*.helpmeencedfiles,*.herbst,*.hnumkhotep,*.hush,*.ifuckedyou,*.info,*.kernel_complete,*.kernel_pid,*.kernel_time,*.keybtc@inbox_com,*.kimcilware,*.kkk,*.kostya,*.kraken,*.kratos,*.kyra,*.lcked,*.LeChiffre,*.legion,*.lesli,*.lock93,*.locked,*.locklock,*.locky,*.lol!,*.loli,*.lovewindows,*.madebyadam,*.magic,*.maya,*.MERRY,*.micro,*.mole,*.MRCR1,*.noproblemwedecfiles​,*.nuclear55,*.odcodc,*.odin,*.onion,*.oops,*.osiris,*.p5tkjw,*.padcrypt,*.paym,*.paymrss,*.payms,*.paymst,*.paymts,*.payrms,*.pays,*.pdcr,*.pec,*.PEGS1,*.perl,*.PoAr2w,*.potato,*.powerfulldecrypt,*.pubg,*.purge,*.pzdc,*.R16m01d05,*.r5a,*.raid10,*.RARE1,*.razy,*.rdm,*.realfs0ciety@sigaint.org.fs0ciety,*.rekt,*.rekt,*.rip,*.RMCM1,*.rmd,*.rnsmwr,*.rokku,*.rrk,*.ruby,*.sage,*.SecureCrypted,*.serp,*.serpent,*.sexy,*.shit,*.spora,*.stn,*.surprise,*.szf,*.theworldisyours,*.thor,*.ttt,*.unavailable,*.vbransom,*.venusf,*.VforVendetta,*.vindows,*.vvv,*.vxlock,*.wallet,*.wcry,*.wflx,*.Whereisyourfiles,*.windows10,*.xxx,*.xxx,*.xyz,*.ytbl,*.zcrypt,*.zepto,*.zorro,*.zyklon,*.zzz,*.zzzzz -File -Force -Recurse | select PSChildName, FullName, LastWriteTimeUTC, Extension | ConvertTo-Html -Fragment + +} + + Write-Host -Fore Cyan "[!] Done" + +} +else { + +} + +#endregion + +########################################################################################################### +#region NETWORK TRACE #################################################################################### +########################################################################################################### + +if ($PCAP) { + + + mkdir PCAP | Out-Null + + Write-Host -Fore DarkCyan "[*] Starting Network Trace" + Write-Host -Fore DarkCyan "[*] Running....." + + netsh trace start capture=yes Ethernet.Type=IPv4 tracefile=PCAP\$env:computername.et1 | Out-Null + Start-Sleep -s 120 + $job = Start-Job { netsh trace stop } | Out-Null + Wait-Job $job + Receive-Job $job + + Write-Host -Fore Cyan "[!] Trace Completed" + + Write-Host -Fore DarkCyan "[*] Converting to PCAP" + #Start-Sleep -s 250 + + + +if ((gwmi win32_operatingsystem | select osarchitecture).osarchitecture -eq "64-bit"){ + + +& $PSScriptRoot\Forensicator-Share\etl2pcapng64.exe PCAP\$env:computername.et1 PCAP\$env:computername.pcap + echo "

NETWORK TRACE:

View PCAP FILES

" | Out-File -Append $FinalDes + +} +else{ + +& $PSScriptRoot\Forensicator-Share\etl2pcapng86.exe PCAP\$env:computername.et1 PCAP\$env:computername.pcap + + echo "

NETWORK TRACE:

View PCAP FILES

" | Out-File -Append $FinalDes +} + + Write-Host -Fore Cyan "[!] Done" + + + +} +else { + + +} + +#endregion + +########################################################################################################### +#region NETWORK TRACE ##################################################################################### +########################################################################################################### + + +########################################################################################################### +#region Export Event Logs ########################################################################## +########################################################################################################### + + + +if ($EVTX) { + + Write-Host -Fore DarkCyan "[*] Gettting hold of some event logs" + + # capture the EVENTLOGS + # Logs to extract from server + $logArray = @("System","Security","Application") + + # Grabs the server name to append to the log file extraction + $servername = $env:computername + + # Provide the path with ending "\" to store the log file extraction. + $destinationpath = "EVTLOGS\" + + # If the destination path does not exist it will create it +if (!(Test-Path -Path $destinationpath)){ + + New-Item -ItemType directory -Path $destinationpath | Out-Null +} + + # Get the current date in YearMonthDay format + $logdate = Get-Date -format yyyyMMddHHmm + + # Start Process Timer + $StopWatch = [system.diagnostics.stopwatch]::startNew() + + +Foreach($log in $logArray){ + + # If using Clear and backup + $destination = $destinationpath + $servername + "-" + $log + "-" + $logdate + ".evtx" + + Write-Host -Fore DarkCyan "[!] Finalizing" + + # Extract each log file listed in $logArray from the local server. + wevtutil epl $log $destination +} + + Write-Host -Fore Cyan "[!] Done" + # End Code + + # Stop Timer + $StopWatch.Stop() + $TotalTime = $StopWatch.Elapsed.TotalSeconds + $TotalTime = [math]::Round($totalTime, 2) + + Write-Host -Fore DarkCyan "[!] Extracting the logs took $TotalTime to Complete." + + + echo "

EVENT LOGS:

View Event Logs

" | Out-File -Append $FinalDes + +} +else { + +} + +#endregion + + +############################################################ +#region GETTING HOLD OF IIS & APACHE WEBLOGS ############### +############################################################ + +if ($WEBLOGS) { + + #Lets get hold of some weblogs + Write-Host -Fore DarkCyan "[*] Lets Get hold of some weblogs" + Write-Host -Fore DarkCyan "[!] NOTE: This can take a while if you have large Apache/IIS Log Files" + + #checking if logs exists in the IIS Log directory +if (!(gci C:\inetpub\logs\ *.log)){ + Write-Host -Fore DarkCyan "[!] Cannot find any logs in IIS Log Directory" +} +else{ + + #create IIS log Dirs + mkdir IISLogs | Out-Null + + $IISLogs = Copy-Item -Path 'C:\inetpub\logs\*' -Destination 'IISLogs' -Recurse | Out-Null + + echo "

IIS Logs

View IIS Logs

" | Out-File -Append $FinalDes + +} + + + #checking for Tomcat and try to get log files + + $FoundRegKey = $null + $ApacheRegKeyExists = (Test-Path 'HKLM:\Software\Apache Software Foundation') + +If ($ApacheRegKeyExists) +{ + Get-ChildItem 'HKLM:\Software\Apache Software Foundation' -Recurse -ErrorAction SilentlyContinue | + ForEach-Object + { + If ($_.Property -match 'InstallPath') + {$FoundRegKey = Get-ItemProperty $_.pspath | Select InstallPath} + } +} +else +{ + Write-Host -Fore DarkCyan "[!] Cannot find Tomcat software keys in registry" + +} + +If ($FoundRegKey) + { + mkdir TomCatLogs | Out-Null + $logfolder=($FoundRegKey.InstallPath+'\logs') + $TomcatLogs = Copy-Item -Path '$logfolder\*' -Destination '$GetLoc\TomCatLogs' -Recurse | Out-Null + echo "

TomCat Logs

View TomCat Logs

" | Out-File -Append $FinalDes + + } +else + { + Write-Host -Fore DarkCyan "[!] Cannot find Tomcat install path in registry" + + } +} +else { + +} + + +#'

' >> $FinalDes + +#endregion + + +############################################################################################################# +#region View Log4j Paths ########################################################################### +############################################################################################################# + +if ($LOG4J) { + + Write-Host -Fore DarkCyan "[*] Checking for log4j on all drives .....this may take a while." + + mkdir LOG4J | Out-Null + # Checking for Log4j + $DriveList = (Get-PSDrive -PSProvider FileSystem).Root + ForEach($Drive In $DriveList) { + $Log4j = gci $Drive -rec -force -include *.jar -ea 0 | foreach {select-string 'JndiLookup.class' $_} | select -exp Path | Out-File LOG4J\$env:computername.txt + echo "

Discovered Log4j

View File

" | Out-File -Append $FinalDes + + } + + Write-Host -Fore Cyan "[!] Done" + + +} +else { + +} + +#'

' >> $FinalDes + +#endregion + + +############################################################################################################# +#region FOOTER ########################################################################### +############################################################################################################# + + +'

' >> $FinalDes + +'
' >> $FinalDes +echo "

Evidence gathered from $env:computername by $operator at: $EndTime with: Live Forensicator

" | Out-File -Append $FinalDes +'
' >> $FinalDes + +Write-Host -Fore DarkCyan "[!] Hang on, the Forensicator is compiling your results" + +#endregion + + +############################################################################################################# +#region NETWORKS SECTION ############################################################################## +############################################################################################################# + +# Making the head for network.html +ConvertTo-Html -Head $head -Title "Live Forensic Output For $env:computername" >$NetDes + +# Header style for Network Page + +$head = '' + +$head >> $NetDes + + +# Making the menus for network.html + +$NetNav = "' + + + + + + +'" + +$NetNav >> $NetDes + +'

' >> $NetDes + + + + +echo "

Network Information

"'' >> $NetDes +if ($NetworkAdapter) {echo "

Network Adapter Information

$NetworkAdapter

" | Out-File -Append $NetDes} +if ($IPConfiguration) {echo "

Current IP Configuration

$IPConfiguration

" | Out-File -Append $NetDes} +if ($NetIPaddress) {echo "

Network Adapter IP Addresses - IPv4 and v6

$NetIPaddress

" | Out-File -Append $NetDes} +if ($NetConnectProfile) {echo "

Current Connection Profiles

$NetConnectProfile

" | Out-File -Append $NetDes} +if ($WlanPasswords) {echo "

Associated WiFi Networks and Passwords

$WlanPasswords

" | Out-File -Append $NetDes} +if ($NetNeighbor) {echo "

Address Resolution Protocol Cache

$NetNeighbor

" | Out-File -Append $NetDes} +if ($NetTCPConnect) {echo "

Current TCP Connections and Associated Processes

$NetTCPConnect

" | Out-File -Append $NetDes} +if ($DNSCache) {echo "

DNS Cache

$DNSCache

" | Out-File -Append $NetDes} +if ($FirewallProfile) {echo "

Current Firewall Rules

$FirewallProfile

" | Out-File -Append $NetDes} +if ($SMBSessions) {echo "

Active SMB sessions (if this device is a server)

$SMBSessions

" | Out-File -Append $NetDes} +if ($SMBShares) {echo "

Active SMB Shares on this device

$SMBShares

" | Out-File -Append $NetDes} +if ($NetHops) {echo "

IP Routes to non local Destinations

$NetHops

" | Out-File -Append $NetDes} +if ($AdaptHops) {echo "

Network Adapters with IP Routes to non Local Destination

$AdaptHops

" | Out-File -Append $NetDes} +if ($IpHops) {echo "

IP Routes with infinite valid lifetime

$IpHops

" | Out-File -Append $NetDes} + + + +'

'>> $NetDes + +'
' >> $NetDes +echo "

Evidence gathered from $env:computername by $operator at: $EndTime with: Live Forensicator

" | Out-File -Append $NetDes +'
' >> $NetDes + +#endregion + + +############################################################################################################# +#region USER & ACCOUNTS SECTION ####################################################################### +############################################################################################################# + +# Making the head for users.html +ConvertTo-Html -Head $head -Title "Live Forensic Output For $env:computername" >$UserDes + +# Header style for Network Page + +$head = '' + +$head >> $UserDes + + +# Making the menus for network.html + +$UserNav = "' + + + + + + +'" + +$UserNav >> $UserDes + +'

' >> $UserDes + + + +echo "

User(s) Information

" | Out-File -Append $UserDes +if ($currentuser) {echo "

Current User Information

$currentuser

" | Out-File -Append $UserDes} +if ($systemname) {echo "

System Details

$systemname

" | Out-File -Append $UserDes} +if ($logonsession) {echo "

Logon Sessions

$logonsession

" | Out-File -Append $UserDes} +if ($userprofiles) {echo "

User Profile

$userprofiles

" | Out-File -Append $UserDes} +if ($administrators) {echo "

Administrator Accounts

$administrators

" | Out-File -Append $UserDes} +if ($LocalGroup) {echo "

Local Groups

$LocalGroup

" | Out-File -Append $UserDes} + + + + + +'

'>> $UserDes + +'
' >> $UserDes +echo "

Evidence gathered from $env:computername by $operator at: $EndTime with: Live Forensicator

" | Out-File -Append $UserDes +'
' >> $UserDes + +#endregion + +############################################################################################################# +#region INSTALLED PROGS | SYSTEM INFO ################################################################## +############################################################################################################# + +# Making the head for system.html +ConvertTo-Html -Head $head -Title "Live Forensic Output For $env:computername" >$SysDes + +# Header style for System Page + +$head = '' + +$head >> $SysDes + + +# Making the menus for system.html + +$SysNav = "' + + + + + + +'" + +$SysNav >> $SysDes + +'

' >> $SysDes + + + +echo "

System Information

" | Out-File -Append $SysDes +if ($InstProgs) {echo "

Installed Programs

$InstProgs

" | Out-File -Append $SysDes} +if ($InstProgs) {echo "

Installed Programs - From Registry

$InstalledApps

" | Out-File -Append $SysDes} +if ($InstProgs) {echo "

Environment Variables

$env

" | Out-File -Append $SysDes} +if ($InstProgs) {echo "

System Information

$systeminfo

" | Out-File -Append $SysDes} +if ($InstProgs) {echo "

Operating System Information

$OSinfo

" | Out-File -Append $SysDes} +if ($InstProgs) {echo "

Hotfixes

$Hotfixes

" | Out-File -Append $SysDes} +if ($InstProgs) {echo "

Windows Defender Status

$WinDefender

" | Out-File -Append $SysDes} + + + + +'

'>> $SysDes + +'
' >> $SysDes +"'

Evidence gathered from $env:computername by $operator at: $EndTime with: Live Forensicator

'" >>$SysDes +'
' >> $SysDes + +#endregion + +############################################################################################################# +#region PROCESSES | SCHEDULED TASK | REGISTRY ########################################################## +############################################################################################################# + +# Making the head for processes.html +ConvertTo-Html -Head $head -Title "Live Forensic Output For $env:computername" >$ProcDes + +# Header style for System Page + +$head = '' + +$head >> $ProcDes + + +# Making the menus for system.html + +$ProcNav = "' + + + + + + +'" + +$ProcNav >> $ProcDes + +'

' >> $ProcDes + + + +echo "

PROCESSES | SCHEDULED TASK | REGISTRY

" | Out-File -Append $ProcDes +if ($Processes) {echo "

Processes

$Processes

" | Out-File -Append $ProcDes} +if ($StartupProgs) {echo "

Startup Programs

$StartupProgs

" | Out-File -Append $ProcDes} +if ($ScheduledTask) {echo "

Scheduled Task

$ScheduledTask

" | Out-File -Append $ProcDes} +if ($ScheduledTask2) {echo "

Scheduled Task & State

$ScheduledTask2

" | Out-File -Append $ProcDes} +if ($Services) {echo "

Services

$Services

" | Out-File -Append $ProcDes} +if ($Services2) {echo "

Services Detailed

$Services2

" | Out-File -Append $ProcDes} +if ($RegRun) {echo "

Persistance in Registry1

$RegRun

" | Out-File -Append $ProcDes} +if ($RegRunOnce) {echo "

Persistance in Registry2

$RegRunOnce

" | Out-File -Append $ProcDes} +if ($RegRunOnceEx) {echo "

Persistance in Registry3

$RegRunOnceEx

" | Out-File -Append $ProcDes} + + + + +'

'>> $ProcDes + +'
' >> $ProcDes +echo "

Evidence gathered from $env:computername by $operator at: $EndTime with: Live Forensicator

" | Out-File -Append $ProcDes +'
' >> $ProcDes + +#endregion + +############################################################################################################# +#region OTHER NOTABLE CHECKS ###################################################################### +############################################################################################################# + +# Making the head for others.html +ConvertTo-Html -Head $head -Title "Live Forensic Output For $env:computername" > $OtherDes + +# Header style for System Page + +$head = '' + +$head >> $OtherDes + + +# Making the menus for system.html + +$OtherNav = "' + + + + + + +'" + +$OtherNav >> $OtherDes + +'

' >> $OtherDes + + + + +echo "

OTHER NOTABLE CHECKS

" | Out-File -Append $OtherDes +if ($LogicalDrives) {echo "

Logical Drives

$LogicalDrives

" | Out-File -Append $OtherDes} +if ($Imagedevice) {echo "

Connected & Disconnected Webcams

$Imagedevice

" | Out-File -Append $OtherDes} +if ($USBDevices) {echo "

USB Devices

$USBDevices

" | Out-File -Append $OtherDes} +if ($UPNPDevices) {echo "

UPNPDevices

$UPNPDevices

" | Out-File -Append $OtherDes} +if ($UnknownDrives) {echo "

All Previously Connected Drives

$UnknownDrives

" | Out-File -Append $OtherDes} +if ($LinkFiles) {echo "

All Files Created in the last 180days

$LinkFiles

" | Out-File -Append $OtherDes} +if ($PSHistory) {echo "

500Days Powershell History

$PSHistory

" | Out-File -Append $OtherDes} +if ($Downloads) {echo "

Executables in the Downloads folder

$Downloads

" | Out-File -Append $OtherDes} +if ($HiddenExecs1) {echo "

Executables In AppData

$HiddenExecs1

" | Out-File -Append $OtherDes} +if ($HiddenExecs2) {echo "

Executables In Temp

$HiddenExecs2

" | Out-File -Append $OtherDes} +if ($HiddenExecs3) {echo "

Executables In Perflogs

$HiddenExecs3

" | Out-File -Append $OtherDes} +if ($HiddenExecs4) {echo "

Executables In Documents Folder

$HiddenExecs4

" | Out-File -Append $OtherDes} +if ($FindFiles) {echo "

Files with same extension as well-known ransomware encrypted files

$FindFiles

" | Out-File -Append $OtherDes} + + +'

' >> $OtherDes + +'
' >> $OtherDes +echo "

Evidence gathered from $env:computername by $operator at: $Endtimecheck with: Live Forensicator

" | Out-File -Append $OtherDes +'
' >> $OtherDes + +#cd $PSScriptRoot + +#endregion + + +if ($ENCRYPTED) { + + Write-Host -Fore DarkCyan "[*] You choose to Encrypt the Artifacts but lets first Archive it" + + $ParentFolder = $PSScriptRoot + "\" + "$env:computername" + "\" #files will be stored with a path relative to this folder + $ZipPath = $PSScriptRoot + "\" + "$env:computername" + "\" + "$env:computername.zip" #the zip file should not be under $ParentFolder or an exception will be raised + +@( 'System.IO.Compression','System.IO.Compression.FileSystem') | % { [void][Reflection.Assembly]::LoadWithPartialName($_) } + Push-Location $ParentFolder #change to the parent folder so we can get $RelativePath + $FileList = (Get-ChildItem '*.*' -File -Recurse) #use the -File argument because empty folders can't be stored +Try{ + $WriteArchive = [IO.Compression.ZipFile]::Open( $ZipPath,'Update') + ForEach ($File in $FileList){ + $RelativePath = (Resolve-Path -LiteralPath "$($File.FullName)" -Relative) -replace '^.\\' #trim leading .\ from path + Try{ + [IO.Compression.ZipFileExtensions]::CreateEntryFromFile($WriteArchive, $File.FullName, $RelativePath, 'Optimal').FullName + }Catch{ #Single file failed - usually inaccessible or in use + Write-Warning "$($File.FullName) could not be archived. `n $($_.Exception.Message)" + } + } +}Catch [Exception]{ #failure to open the zip file + Write-Error $_.Exception +}Finally{ + $WriteArchive.Dispose() #always close the zip file so it can be read later + #Remove-Item -Exclude *.zip -Recurse -Force + Get-ChildItem * -Exclude *.zip -Recurse | Remove-Item -Force -Recurse +} + +Write-Host -Fore DarkCyan "[*] Artifacts Archived, now lets encrypt it..." + +Pop-Location + + + +$Password = ( -join ((0x30..0x39) + ( 0x41..0x5A) + ( 0x61..0x7A) | Get-Random -Count 12 | % {[char]$_}) ) + +$MYTEXT = $Password +$ENCODED = [Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes($MYTEXT)) +#Write-Host $ENCODED | Out-File .\key.txt +Write-Host $ENCODED +echo YOUR ENCRYPTION KEY IS: $ENCODED | Out-File -Force .\key.txt + +Write-Host -Fore DarkCyan "[!] That is your Encryption key please keep it safe" + +# Define target file types +$TargetFiles = '*.zip' +$TargetPath = $PSScriptRoot + "\" + "$env:computername" + "\" +$Extension = ".forensicator" +$Key = $ENCODED + +# Import FileCryptography module +Import-Module "$PSScriptRoot\Forensicator-Share\FileCryptography.psm1" + + + # Gather all files from the target path and its subdirectories + $FilesToEncrypt = get-childitem -path $TargetPath\* -Include $TargetFiles -Exclude *$Extension -Recurse -force | where { ! $_.PSIsContainer } + $NumFiles = $FilesToEncrypt.length + + # Encrypt the files + foreach ($file in $FilesToEncrypt) + { + Write-Host "Encrypting $file" + Protect-File $file -Algorithm AES -KeyAsPlainText $key -Suffix $Extension -RemoveSource + } + Write-Host "Encrypted $NumFiles files." | Start-Sleep -Seconds 10 + +Write-Host -Fore DarkCyan "[*] Artifact Encrypted successfully" + +Write-Host -Fore Cyan "[!] All Done... you can find the key in the Artifact Folder" + +cd $PSScriptRoot + + + +} +else { + +cd $PSScriptRoot + +Write-Host -Fore Cyan "[!] All Done... you can find the results in the script execution folder" + +} + + +Write-Host '' +Write-Host '' +Write-Host ''