DATA PRESERVATION

Out-of-Band Data Preservation.

Secure, zero-touch extraction of Chromium browser data. Bypass strict SMB file-sharing firewalls by encoding raw SQLite bookmark databases into Base64 streams and extracting them over WinRM or RPC.

SEE HOW IT WORKS
WinRM / RPC Dispatcher ● CONNECTED

[UHDC] REMOTE DATA PRESERVATION ENGINE

[i] Attempting connection to LAPTOP-US-4829 via WinRM...

> Extracting and encoding bookmarks...

> Decoding Base64 streams and reconstructing files...

> [OK] Chrome Bookmarks successfully secured.

> [OK] Edge Bookmarks successfully secured.

[UHDC SUCCESS] Extraction complete. Rendering local destination...

> C:\UHDC\Bookmarks\LAPTOP-US-4829-jsmith-20260302-1422

The Administrative Safety Net

When a user's Windows profile becomes corrupted or they are scheduled for an immediate hardware replacement, a manual profile wipe risks permanent data loss. This engine acts as a targeted safety net to rescue critical local data instantly, even on highly restricted networks.

Out-of-Band Extraction

Executes a payload locally on the target that reads the SQLite databases, encodes them into Base64 strings, and transmits them back to the console via standard output streams, bypassing SMB blocks entirely.

Local Reconstruction

The console catches the Base64 output, decodes the byte arrays, and automatically reconstructs the files into a local, timestamped destination folder (e.g., C:\UHDC\Bookmarks\...) on the technician's machine.

Shell Handoff

Executes explorer.exe with the /select argument, breaking out of the PowerShell runspace to visually highlight the newly created backup folder directly on the technician's screen.

INTERACTIVE TRAINING ENGINE
⭐ 100 XP

How Junior Techs Learn This Tool:

While the UHDC uses a complex Base64 encoding pipeline to bypass strict SMB firewalls, a junior technician should know how to manually extract files over the network using classic administrative shares. The training engine teaches them how to utilize the built-in xcopy command to reach directly into the target's hidden C$ share and pull their Chrome bookmarks file straight to their local desktop.

xcopy "\\$Target\C$\Users\$TargetUser\AppData\Local\Google\Chrome\User Data\Default\Bookmarks" "%USERPROFILE%\Desktop\" /Y

The In-Person Equivalent

Opening File Explorer, typing '%LocalAppData%\Google\Chrome\User Data\Default' into the address bar, copying the 'Bookmarks' file, and saving it to a flash drive.

Technical Q&A

Q: Why use Base64 encoding over standard output streams instead of just copying the file via SMB?
Modern enterprise firewalls frequently block SMB (Port 445) to prevent lateral movement and ransomware spread. By reading the file locally on the target, encoding it into text, and passing it back through the WinRM or PsExec output stream, we completely bypass file-sharing restrictions and extract the data securely.
Q: Does this backup the user's saved passwords or browsing history?
No. It only backs up the Bookmarks file. Saved passwords in Chromium browsers are encrypted using the user's unique Windows DPAPI (Data Protection API) key. You cannot simply copy a password file from one PC to another; it will be unreadable. If a user needs their passwords transferred, they must sign into a browser sync profile.
Q: What does the `/select` argument do in the final step?
When you run explorer.exe "C:\Folder", Windows opens that folder. When you run explorer.exe /select,"C:\Folder", Windows opens the parent directory and automatically highlights the specific folder. This is a quality-of-life feature that saves the technician from having to hunt for the newly created backup among dozens of other files.