Computer and operating system
Collects computer name, manufacturer, model, BIOS information, Windows caption/version, motherboard information, and related system details.
Windows Information Collection Utility
Recon
Recon is a PowerShell-based Windows information-collection utility that gathers an extensive snapshot of the current computer, user account, networking, software, hardware, activity, browser, and Wi-Fi configuration into local output files and a ZIP archive.
Privacy-sensitive tool. The current script collects significantly more than basic hardware information. It can collect saved Wi-Fi passwords, browser history/bookmarks, PowerShell history, recent file paths, public/local network information, geolocation, process/service data, local user details, and other information. Run it only on a computer you own or are explicitly authorized to inspect.
System Inventory
Hardware and Windows information
Recon gathers a broad inventory of the computer using Windows CIM/WMI, registry, networking, process, service, and command-line interfaces.
CPU, RAM, and GPU
Records processor details, installed memory capacity and module information, and graphics adapter/driver/resolution information.
Storage and devices
Enumerates logical drives, volume labels, drive types, file systems, serial numbers, capacity/free space, and connected USB/COM-style devices.
Drivers and installed software
Collects signed Plug-and-Play driver information and traditional installed-software entries from the machine uninstall registry.
Accounts & Security State
User and Windows security configuration
Local users
Enumerates Windows user-account information including caption, domain, name, full name, and SID.
UAC state
Reads Windows UAC policy values and maps them to the configured notification level.
LSASS state
Checks whether the Local Security Authority process reports that it is running as a protected process.
RDP state
Reads the Terminal Server registry setting to report whether Remote Desktop connections are enabled.
Network Data
IP, adapters, Wi-Fi, and active connections
Public and local IP information
The script queries ipinfo.io/ip for the public IP address and gathers local Ethernet/Wi-Fi IPv4 addresses, prefix origin, adapter status, and MAC addresses.
Nearby Wi-Fi
Uses netsh wlan show networks mode=Bssid to collect nearby SSIDs along with authentication and encryption information.
Saved Wi-Fi profiles
The current script enumerates saved WLAN profiles and requests profile details with keys shown in clear text, then records the profile names and recovered password values.
TCP connections
Collects local/remote address information, connection states, applied settings, owning process IDs, and attempts to associate connections with processes.
The saved-Wi-Fi section can expose network credentials in the generated output. Treat the Recon results folder and ZIP as sensitive data.
User Activity
Recent files, shell history, and profile contents
User profile tree
Runs the Windows tree command against the current user profile with files included, producing a directory/file listing.
PowerShell history
Copies the current user's PSReadLine ConsoleHost history into the Recon output folder.
Recent files
Recursively scans the current user profile, sorts files by last-write time, and records the 50 most recently modified file paths.
Startup folder
Records the file names currently present in the user's Windows Startup folder.
Browser Data
Browser history and bookmarks
The current script attempts to read local browser data files and extract URL-like text from them.
Microsoft Edge
Targets the Default profile's History database and Bookmarks file.
Google Chrome
Targets the Default profile's History database and Bookmarks file.
Mozilla Firefox
Targets places.sqlite under a *.default-release profile for history-related URL extraction.
Combined browser output
Matched browser records are appended to a local BrowserData.txt file in the Recon results folder.
Location
Geolocation request
Recon loads the Windows System.Device assembly and uses GeoCoordinateWatcher to request location information. When Windows grants access and a result is available, latitude and longitude are included in the computer-data output.
Processes, Services & Tasks
Running and configured Windows components
Processes
Records process handle, process name, executable path, and command line through WMI.
Services
Records Windows service state, internal name, display name, and executable/path information.
Scheduled tasks
Runs Get-ScheduledTask and includes the task information in the collected results.
Logon sessions
Runs klist sessions and stores the resulting Windows authentication-session information.
Output
Local results folder and ZIP archive
Recon creates a timestamped folder under the current user's temporary directory using a name based on the Windows username. It gathers multiple text files there, copies the results folder to the script directory, and also creates a ZIP archive in the temporary directory.
The included Read Me says the run is complete when a new results folder appears in the script directory.
Optional Upload Functions
Dropbox and Discord support in the current script
The current source contains optional Dropbox and Discord upload functions. They only execute when the corresponding configuration variables are populated.
Dropbox
If the Dropbox token variable is populated, the script can upload the generated ZIP archive through the Dropbox content API.
Discord
If the Discord webhook variable is populated, the script can send the ZIP archive to that configured webhook.
Before distributing or using Recon, inspect those configuration values yourself. Any populated external-upload credential changes the privacy behavior of the script.
Cleanup
History and temporary-data removal
At the end of the current script, Recon performs additional cleanup beyond deleting its own working files.
Temporary folder cleanup
The script recursively attempts to remove contents under the current user's %TEMP% directory.
Run-dialog history
Deletes values under the current user's Windows RunMRU registry key.
PowerShell history
Removes the PSReadLine history file after having previously copied that history into the Recon results.
Recycle Bin
Runs Clear-RecycleBin -Force, which empties the Windows Recycle Bin.
These cleanup actions can remove unrelated user data/history. In particular, clearing
%TEMP% and the Recycle Bin affects more than Recon's own output.
How To Run
Launching Recon
- Run Recon only on a computer you own or are explicitly authorized to inspect.
- Download and extract Recon.zip.
- Review Recon.ps1, especially any Dropbox or Discord configuration values, before execution.
- Run Run Me.bat.
- The launcher starts PowerShell with -ExecutionPolicy Bypass and requests administrator elevation through UAC.
- The PowerShell console is hidden while the collection runs.
- Recon gathers system, account, network, activity, browser, and Wi-Fi information into a temporary results folder.
- A copy of the results folder is placed in the script directory and a ZIP archive is created.
- If optional upload configuration is populated, the ZIP may also be sent to the configured external service.
- The script then performs its configured cleanup actions.
FAQ
Frequently asked questions
Is Recon only a hardware-information tool?
No. The current script also collects user, network, browser, Wi-Fi, recent-file, process, service, task, session, and activity information.
Can it collect saved Wi-Fi passwords?
Yes. The current script requests saved WLAN profile information with clear-text keys and records the recovered values.
Can it collect browser history?
Yes. It attempts URL extraction from Edge, Chrome, and Firefox browser data files.
Does it collect location?
It requests Windows geolocation data and includes latitude/longitude when Windows permits access and a coordinate is available.
Can it upload the results?
The current script contains optional Dropbox and Discord upload functions that execute when their corresponding configuration values are populated.
Does it remove history afterward?
Yes. The current script includes cleanup commands for temporary files, Run history, PowerShell history, and the Recycle Bin.