> For the complete documentation index, see [llms.txt](https://windows.dfirhandbook.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://windows.dfirhandbook.com/windows-dfir-and-mittr/collection.md).

# Collection

* T1056: Input Capture
* T1113: Screen Capture
* T1125: Video Capture
* T1119: Automated Collection
* T1123: Audio Capture
* T1005: Data from Local System
* T1039: Data from Network Shared Drive
* T1025: Data from Removable Media
* T1074: Data Staged
* T1213: Data from Information Repositories
* T1114: Email Collection
* T1056.001: Keylogging
* T1115: Clipboard Data
* T1120: Peripheral Device Discovery
* T1124: System Time Discovery