So what are we going to do to retrieve information?
Well first off, as we start to structure information here,
you can see that the logic we're using is as simple
as a variable with some values.
So if we take ComputerInfo, for example,
ComputerInfo is a variable that we're creating to utilize later,
but we're populating it with Get‑SystemInfo,
which was the function that we created to get all of the details.
You can also see if we go a bit further we've got another one that's
invoking a command check to see if Get‑LocalUser is available.
If it is, you can see we have PowerShell commands to execute.
If it doesn't, then go and call the CimInstance commands and do the same thing.
So as I scroll down here, you can see lots and lots of these variables.
Let's just kind of put some space here and focus on these.
You can see retrieving memory information by using the Get‑CimInstance objects.
So, operating system, and then I scroll across, and
we're pulling out various properties,
converting to HTML, and then setting it so it will just render.
Same goes for OperatingSystem, Processes,
the BIOS, and LogicalDisks.
If we go a bit further up here, then, of course,
as we go down, we can start to add other functions and use other commands.
So I wanted to get a list of all the Windows features.
There's a PowerShell command for that,
Get‑WindowsOptionalFeature, and then go ahead and retrieve that information.
So you can see we have this large list of information.
You can see we're using autorunsc.exe, so we're into the
Sysinternals objects at this point.
But as we scroll all the way down, now we get to the
most important bit, the contentSets.
So the contentSets is an array, and the array contains,
I suppose, smaller arrays or hash tables of data underneath.
And the idea here is that we specify a title,
so Computer Information. And then we specify the content,
which is the variables that we populated.
You can see that some of these have the syntax of pre, and that's because we
need a little bit of help using HTML to get it to render correctly and keep
it in its format so it fits in the block. But the more kind of rows that we
add here, so you can see we've got all these different rows, so this is all
going to get populated.
And then we take all of that object, that contentSets
one, and we simply say New‑HtmlDocument,
which you remember is our custom report.
Give it the FilePath, which we already have as available.
Type the contentSets are above this lot here, all of this.
And then we take the Css we looked at and the LogoPath, and then we
execute, and that generates the HTML document.
And then just to make it easier for myself in the script,
we start the process, and it just renders.
So that's how the script kind of functions.
That's how things load together.
So let's look at creating a smaller version of this one.
So even though all of these pieces are here,
what we're going to do is this contentSets piece. I'm just going to make it
a smaller version, so let me just select. I just want to take a copy of this
because I'm going to delete some of this out.
So we'll just launch Notepad here.
We'll paste that into there, and then all we'll do is we'll
cut everything out from Disk Information.
There we go. Everything from there down we'll get rid of.
So this will create a small report for us.
This will retrieve the Computer Information,
Memory, Operating System, all the local user log‑on
details, and then some Disk Information.
So let's save that.
So now we have everything in here.
Obviously, everything's going to execute, so it will take a bit of time,
but let's go into our console again.
And the first thing we'll do is I'm going to go back to my path that I need.
So I'm going to grab my forensics path.
I'm going to say push directory,
paste it into there, and then I'll do cd Code. And then
we'll go and execute our Globo.ps1.
Now this will take a few seconds to run or maybe a little
bit longer, depending on the speed,
but it's now going to execute all of the functions that we
built, use all of the variables that we created.
It's also going to go through and call all of the
contentSet commands that we had, which are going to pull information out.
And then it's only going to display that subset of information using
the contentSets that we created at the bottom.
So we'll give this a second to complete.
So our report was built. You can see that our list of
options on the table of contents is shorter, and it
retrieves all the information as expected.
So Operating System, Application Information. If we go
back up here, if we do BIOS Information,
you can see all of these details are rendered for us.
So it's a very simple way of being able to get the information
and present it in a way that makes sense.
So let's just close that. Let's go back to our Visual
Studio Code. So from a code perspective,
obviously, there's a lot of information here,
but all of these functions you can see there's mixes of using
CimInstance, as well as using other variables.
So, for example, ServicesInfo here. You're going to go and get
the list of services, using CimInstance.
And then I obviously wanted to break that down into services that are
either running or stopped or started and have different colors, and so you
can see it's been wrapped with specific syntax. We're then using
out‑of‑the‑box ones such as Get‑NetFirewall.
We're also using Sysinternals options, as well as other functions
that exist, even down to using just commands like klist that we
looked at before that do the same thing.
Now, of course, you can add or remove as many of these things as needed.
So if we didn't need half of this, then if I was looking back at my list,
this goes to Disk Information, maybe I would want to go all the way up to here,
look for Disk Information, and then say,
you know what?
I just want to delete everything else out of here.
In actual fact, if we go all the way down through here,
and if I delete all of this to make our script a little bit smaller,
what we can then do is make sure that everything matches.
So I've got ComputerInfo, Memory, OS, and then I've got ProcessInfo.
So let's get rid of our logged in information and all of this
and then our BIOS and Disk Information.
So now we can create smaller sets of reports. But that's as simple as it is.
But if we look at the functions that are being called,
so let's go and look at MemoryInfo.
Let's go back over to here, and we'll just paste that MemoryInfo option.
You can see it's very quick.
And then when I do MemoryInfo, it obviously returns those values.
And that's because it's using the operating system CimInstance,
getting the values that we need, and then converting to HTML.
And that's the same for all of these options where it's
just using standard CimInstance commands.
So I would recommend that you utilize a mix of those as needed.
So obviously,
we have that. We can now execute that. We can run it on a different machine.