diff --git a/Get-WindowsEventActivity.ps1 b/Get-WindowsEventActivity.ps1 index 6d5102f..88ad458 100644 --- a/Get-WindowsEventActivity.ps1 +++ b/Get-WindowsEventActivity.ps1 @@ -13,7 +13,6 @@ param( $Error.Clear() -#region Interrogate Windows event logs ## Query all event logs to search $logs = (Get-WinEvent -ListLog '*' -ErrorAction SilentlyContinue | Where-Object {$_.RecordCount}).LogName ## Filter event logs based on my timeframe @@ -25,9 +24,7 @@ $FilterTable = @{ $winEvents = Get-WinEvent -FilterHashTable $FilterTable -ErrorAction SilentlyContinue | Sort-Object -Property TimeCreated $winEvents | Export-Csv -Path '.\LogActivity-eventlogs.csv' -Append -## Output to CSV maybe here -#endregion -#region Interrogate text files + ## Find all local volumes $drives = (Get-PSDrive -PSProvider FileSystem -Scope Local -ErrorAction SilentlyContinue).where({ $_.Root -match '\w{1}:\\$'}) | Select-Object -ExpandProperty Root $drives = "C:\" @@ -36,6 +33,3 @@ $searchPattern = $LogFileExtension | ForEach-Object { "*.$_" } Get-ChildItem -Path $drives -Include $searchPattern -Recurse -File -ErrorAction SilentlyContinue | Where-Object { $_.LastWriteTime -ge $StartTimestamp -and $_.LastWriteTime -le $EndTimestamp } | Export-Csv -Path '.\LogActivity-textlogs.csv' -Append -## Find all of the text files with the last write time within my timeframe -## Output to CSV? -#endregion \ No newline at end of file