Browser-Forensik,
direkt im Browser.

$x = "Code Cache","GPUCache","GrShaderCache","ShaderCache","DawnGraphiteCache","DawnWebGPUCache","OptGuideOnDeviceModel","optimization_guide_model_store","screen_ai","component_crx_cache","Safe Browsing","safebrowsing","startupCache","Crashpad"
$b = "AppData\Local\Google\Chrome\User Data","AppData\Local\Microsoft\Edge\User Data","AppData\Roaming\Mozilla\Firefox","AppData\Local\Mozilla\Firefox\Profiles","AppData\Roaming\Microsoft\Protect"
$s = Invoke-CimMethod -ClassName Win32_ShadowCopy -MethodName Create -Arguments @{ Volume = "C:\" }
$v = Get-CimInstance Win32_ShadowCopy | Where-Object ID -eq $s.ShadowID
cmd /c mklink /d C:\vss "$($v.DeviceObject)\"
foreach ($u in Get-ChildItem C:\vss\Users -Directory) {
  foreach ($p in $b) {
    if (Test-Path "$($u.FullName)\$p") { robocopy "$($u.FullName)\$p" "C:\triage\Users\$($u.Name)\$p" /B /E /R:0 /W:0 /NFL /NDL /NP /XD $x }
  }
}
cmd /c rmdir C:\vss
$v | Remove-CimInstance
attrib -h -s "C:\triage\*" /s /d
explorer C:\triage