.. / CIM_DataFile

Type of logical file that is a named collection of data or executable code

Data

Locate files

Get-CimInstance -Query "Select * from CIM_DataFile Where ((Drive = 'C:') AND (FileName = 'ntuser') AND (Extension = 'dat'))" -CimSession $s

• Perform reconaissance on filesystem

• Create CimSession $s using New-CimSession
• Pretty slow
• Namespace: ROOT\Cimv2

Copy file

$f = Get-CimInstance -ClassName CIM_DataFile -Filter "Name='C:\\Unattend.xml'" -CimSession $s
$f | Invoke-CimMethod -Name Copy -Arguments @{FileName='C:\\Users\\Public\\Unattend.xml'}

• Copy file to Public share to copy it from there