Clean up Desktop and Temporary Files; Resolves #517

mandiant · Nov 16, 2023 · 4fa0631 · 4fa0631
1 parent 2132656
commit 4fa0631
Show file tree

Hide file tree

Showing 2 changed files with 58 additions and 1 deletion.
diff --git a/packages/common.vm/common.vm.nuspec b/packages/common.vm/common.vm.nuspec
@@ -2,7 +2,7 @@
 <package xmlns="http://schemas.microsoft.com/packaging/2015/06/nuspec.xsd">
   <metadata>
     <id>common.vm</id>
-    <version>0.0.0.20231027</version>
+    <version>0.0.0.20231115</version>
     <description>Common libraries for VM-packages</description>
     <authors>Mandiant</authors>
   </metadata>

diff --git a/packages/common.vm/tools/vm.common/vm.common.psm1 b/packages/common.vm/tools/vm.common/vm.common.psm1
@@ -1244,3 +1244,60 @@ public class Shell {
         VM-Write-Log-Exception $_
     }
 }
+
+
+# Usage example:
+# VM-Remove-DesktopFilesExcept -excludeFolders "PS_Transcripts", "Tools", "fakenet_logs" -excludeFiles "example.txt", "important.doc"
+function VM-Remove-DesktopFilesExcept {
+    param (
+        [Parameter(Mandatory=$false)]
+        [string[]]$excludeFolders,
+        [Parameter(Mandatory=$false)]
+        [string[]]$excludeFiles
+    )
+    $userAccounts = @(
+        [System.Environment]::GetFolderPath([System.Environment+SpecialFolder]::Desktop), # Current user's desktop
+        [System.Environment]::GetFolderPath([System.Environment+SpecialFolder]::CommonDesktopDirectory) # Public desktop
+    )
+    foreach ($userDesktopPath in $userAccounts) {
+        Get-ChildItem -Path $userDesktopPath | ForEach-Object {
+            $item = $_
+            VM-Write-Log "INFO" "Processing item: $($item.FullName)"
+            try{
+                if ($item.PSIsContainer -and $item.Name -notin $excludeFolders) {
+                    VM-Write-Log "INFO" "Deleting folder: $($item.FullName)"
+                    Remove-Item -Path $item.FullName -Recurse -Force
+                }
+                elseif ($item.PSIsContainer -eq $false -and $item.Name -notin $excludeFiles) {
+                    VM-Write-Log "INFO" "Deleting file: $($item.FullName)"
+                    Remove-Item -Path $item.FullName -Force
+                }
+            } catch {
+                VM-Write-Log-Exception $_
+            }
+        }
+    }
+}
+
+function VM-Clear-TempAndCache {
+    $temp = [System.IO.Path]::GetTempPath()
+    $chocolatey = Join-Path $temp 'chocolatey'
+    $nugetCache = [System.IO.Path]::Combine([System.Environment]::GetFolderPath('LocalApplicationData'), 'NuGet\cache')
+    $packageCache1 = [System.IO.Path]::Combine([System.Environment]::GetFolderPath('LocalApplicationData'), 'Package` Cache')
+    $packageCache2 = [System.IO.Path]::Combine([System.Environment]::GetFolderPath('CommonApplicationData'), 'Package` Cache')
+
+    $command1 = 'cmd /c del /Q /S ' + $temp
+    $command2 = 'cmd /c rmdir /Q /S ' + $chocolatey + ' ' + $nugetCache + ' ' + $packageCache1 + ' ' + $packageCache2
+
+    Invoke-Expression $command1
+    Invoke-Expression $command2
+}
+
+function VM-Run-DiskCleanup {
+    cmd /c cleanmgr.exe /AUTOCLEAN
+}
+
+# SDelete can take a bit of time (~2+ mins) and requires sysinternals to be installed
+function VM-Clear-FreeSpace {
+    cmd /c sdelete -accepteula -nobanner -z C:
+}