Lab 9a Scripting Practice

@echo off

REM This script will collect volatile information from a Windows system.

:TKT
set /p TKTNUM=What is the ticket number for this report? (e.g. 0001):
ECHO You entered: "%TKTNUM%"
set /p CHKTKT=Is this correct? (y/n)
If /i "%CHKTKT%"=="n" goto :TKT
cls

:USR
set /p USRNAME=Enter the userID authenticated at the time of the incident (e.g. bmookie):
ECHO You entered: "%USRNAME%"
set /p USR=Is this correct? (y/n)
If /i "%USR%"=="n" goto :USR
cls

REM Create location to save results
mkdir %TKTNUM%-%COMPUTERNAME%-Results
set resultsDir=%TKTNUM%-%COMPUTERNAME%-Results

REM Run commands to collect system information.
echo "Collecting Running Processes"
tasklist /svc /FO CSV > "%resultsDir%\tasklist.csv"

echo "Collecting network statistics"
netstat -an > "%resultsDir%\netstat.txt"

echo "Collecting contents of the C Directory"
tree /A C:\ > "%resultsDir%\TreeList.txt"

REM Too much work to figure out how to get the file naming right
REM FILE=C:\Users\champuser\Downloads\0001-DESKTOP-P1PH8V7-Results
REM if test -f "$FILE"; then
    REM echo "$FILE exists."

echo "Getting the information of the system."
systeminfo > "%ResultsDir%\Systeminfo.txt"

echo "Script Finished :)"

Last updated