# Digital Forensics Collector

Collects common forensic artifacts (system info, network connections, prefetch, browser history, installed programs, USB devices, jumplists, shellbags) from a Windows PC. Only use on a machine you own or have permission to examine.

How to run

1. Put run.bat and DigitalForensicsCollector.ps1 in the same folder.
2. Double-click run.bat.
3. Accept the admin prompt.
4. In the app, pick your artifacts, tick the legal-authority box, and click Collect Now.

Output

Results save to an Outputs folder next to the script, in a new timestamped subfolder each run:

• Raw Output — original copied files
• Readable Output — CSV reports

Notes

• Browser history/cookies are parsed into CSV automatically. Saved passwords are never decrypted or extracted.
• If sqlite3.exe isn't on your PATH, browser CSVs use an approximate method.
• If PowerShell blocks the script, run this once in an admin PowerShell window: Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass