Data Mining

[Gitsnik]

It's also worth building a sort of default list of a directory structure when you automate these sorts of things.

That is, C:\Program Files is probably not worth looking at (as a final folder), but C:\Backup is, in the same way that C:\WINDOWS\cmd.exe is worth looking into but C:\WINDOWS\System32\cmd.exe is not.

I like to always grab a list of dot files/folders in a users home directory, .ssh is always interesting, but .lesshst or .viminfo are probably not so much. .bashrc is a bit of a hit and miss winner and so on, but you can programatically eliminate a lot of information by comparing them to a known not-so-hot list.

[lupin]

Something else I should have realised when I gave my earlier answer about what languages could be used for this purpose... Meterpreter has irb support, so you can do some Ruby scripting with it! So Ruby might be a possibility for this project...

Some references:
Metasploit: Post-exploitation fun in Metasploit 3.0
Useful API Calls

[Thorn]

A tool that I was just made aware of that seems to fit right in this topic is Cornell Spider. Open-source Forensics Tools for Network and System Administrators

Spider scans a drive for US Social Security (SSN), Canadian social insurance (SIN), credit card, bank routing numbers, or International Bank Account Numbers (IBAN). It's available as Win and OSX executables, and *nix source code. I'm going to give it a test on some files which have with some fake SSNs.

[lupin]

More Meterpreter awesomeness that might apply here:

Railgun!, included in Metasploit 3.4.1! Just do a Metasploit update in BT to get access.