So we're back on our Windows machine, and this time you can see
we've opened up Visual Studio Code. It can be any editor, I just
have a preference using Visual Studio Code, and I have a structure
that I've built with some files.
So first off, I'm just going to expand this file structure.
You can see that we have a root folder, which then has a Sysinternals folder,
which if we expand it is just all of the Sysinternals.
It's just easier to put them into a structure,
especially when you want to execute a PowerShell script or something else,
you want to know that that path is going to be the same.
I've then got a logo, which if I click here, it's just the
Globomantics company logo that we utilize.
I've then got a code folder with a ps1 called Globo,
which we'll go into shortly, a report folder with an empty
logs directory, which will be the output of all the CSV
files that we wish to utilize.
And then of course,
I've got the report, which is one that we generated earlier, and
then I've got an Export.ps1, which will be the PowerShell script
we'll use to export or at least a function you can look at to kind
of export the information out.
So that's kind of our structure, so the idea is here,
we have everything in one folder, which will be this root
level power forensics one that's called here,
PowerShell‑Live Forensics and Response, and we'll copy that folder into a
machine with everything intact and all the paths will work.
So when we looked at the tasks,
one of the first tasks is to start building all of the pieces that tie
everything together, so the variables and the functions.
So I'm going to click on Globo.ps1, and what we'll do here is I'm just going
to choose view over here, and I've got rid of the mini map,
which was over here.
You know what, I can actually just slide over here and
we'll get rid of it, there we go.
So, the first section here is variables.
So I've put the functions in here so we can see then we're going
to step through them so we know how they work.
The first thing you'll see is that I've created some
variables, and it's on my machine here, which is a Windows 10 machine.
I'm obviously using a trainer account, and then I'm using various folders.
So my four variables that I'm creating is the path to the logo itself, the
name of the report that I want to create, the location that I want to store
the report, and then the path to the Sysinternals.
Now, I'm using the full path, but in reality,
I could have used the short alias paths if I needed to, but that just
means that what I would do is I would get rid of,
for example,
all of this piece here, and maybe my path would be something
like that, for example. It would just be that, so, basically,
whatever the root folder is,
that's where I want it to look. For the purposes of the
demonstration and to make sure it works,
I'm just going to go through and do it this way, so I hard coded the values.
So those are our four variables, the image that loads at the top of our report,
the HTML report name, the output, and then the actual path to the Sysinternals.