Pulling logs off a windows computer is not a easy task.. but with Powershell it can help you wrap up a long Friday
# Run this script as Administrator
$timestamp = Get-Date -Format "yyyyMMdd_HHmmss"
$outputDir = "C:\ForensicLogs\$env:COMPUTERNAME-$timestamp"
New-Item -Path $outputDir -ItemType Directory -Force | Out-Null
Write-Host "Saving forensic logs to $outputDir`n"
# --------------------------
# 1. Event Logs for Timeline
# --------------------------
$logNames = @(
"System",
"Application",
"Security",
"Setup",
"Microsoft-Windows-PowerShell/Operational",
"Microsoft-Windows-WMI-Activity/Operational",
"Microsoft-Windows-Sysmon/Operational",
"Microsoft-Windows-TerminalServices-LocalSessionManager/Operational",
"Microsoft-Windows-TaskScheduler/Operational"
)
foreach ($log in $logNames) {
$safeName =
$log -replace '[\\/]','_'
$evtxPath = Join-Path $outputDir "$safeName.evtx"
try {
wevtutil epl "$log" "$evtxPath"
} catch {
Write-Warning "Failed to export
$log: $_"
}
}
# --------------------------
# 2. File System Timeline
# --------------------------
Write-Host "Collecting file system timeline (C:\)..."
$timelinePath = Join-Path $outputDir "FileTimeline.csv"
Get-ChildItem -Path C:\ -Recurse -Force -ErrorAction SilentlyContinue |
Where-Object { -not $_.PSIsContainer } |
Select-Object FullName, CreationTime, LastAccessTime, LastWriteTime, Length |
Export-Csv $timelinePath -NoTypeInformation
# --------------------------
# 3. Registry Hives
# --------------------------
Write-Host "Exporting registry hives..."
$regOut = Join-Path $outputDir "Registry"
New-Item -Path
$regOut -ItemType Directory -Force | Out-Null
reg save HKLM\SYSTEM "$regOut\
SYSTEM.hiv" /y
reg save HKLM\SOFTWARE "$regOut\
SOFTWARE.hiv" /y
reg save HKU ".DEFAULT" "$regOut\
DEFAULT.hiv" /y
# Export all loaded user hives
Get-ChildItem "HKU:\" | ForEach-Object {
$sid = $_.PSChildName
if ($sid -match "S-1-5-21.*") {
$path = Join-Path
$regOut "$sid.hiv"
reg save "HKU\$sid"
$path /y
}
}
# --------------------------
# 4. User Login History
# --------------------------
Write-Host "Extracting login history..."
$loginOut = Join-Path $outputDir "UserLogins.csv"
Get-WinEvent -LogName Security |
Where-Object { $_.Id -in 4624, 4634 } | # 4624: logon, 4634: logoff
Select-Object TimeCreated, Id, @{Name="Account";Expression={$_.Properties[5].Value}}, Message |
Export-Csv $loginOut -NoTypeInformation
# --------------------------
# 5. Browser History (Chrome & Edge)
# --------------------------
Write-Host "Extracting browser history (if Chrome/Edge installed)..."
function Export-BrowserHistory {
param($browser, $userPath, $fileName)
$historyPath = Join-Path $userPath "$browser\User Data\Default\History"
if (Test-Path $historyPath) {
$dest = Join-Path $outputDir $fileName
Copy-Item $historyPath
$dest -Force
Write-Host "Copied $browser history to
$dest"
}
}
Get-ChildItem C:\Users -Exclude "Default*", "Public", "All Users", "Administrator" | ForEach-Object {
$userPath = $_.FullName
Export-BrowserHistory -browser "Google\Chrome" -userPath $userPath -fileName "$($_.Name)_ChromeHistory"
Export-BrowserHistory -browser "Microsoft\Edge" -userPath $userPath -fileName "$($_.Name)_EdgeHistory"
}
Write-Host "`nCollection Complete: $outputDir"