Add miscellaneous Windows artefacts (#113)

(DIS-2134)

acquire/acquire.py

@@ -603,6 +603,8 @@ class Tasks(Module):
         ("dir", "sysvol/windows/syswow64/tasks"),
         ("dir", "sysvol/windows/sysvol/domain/policies"),
         ("dir", "sysvol/windows/system32/GroupPolicy/DataStore/"),
+        # Task Scheduler Service transaction log
+        ("file", "sysvol/SchedLgU.txt"),
     ]
 
 
@@ -671,6 +673,15 @@ class Recents(Module):
     ]
 
 
+@register_module("--startup")
+class Startup(Module):
+    DESC = "Windows Startup folder"
+    SPEC = [
+        ("dir", "sysvol/ProgramData/Microsoft/Windows/Start Menu/Programs/Startup"),
+        ("dir", "AppData/Roaming/Microsoft/Windows/Start Menu/Programs/Startup", from_user_home),
+    ]
+
+
 def recyclebin_filter(path: fsutil.TargetPath) -> bool:
     return bool(path.stat().st_size >= (10 * 1024 * 1024))  # 10MB
 
@@ -1642,7 +1653,7 @@ def _run(cls, target: Target, cli_args: argparse.Namespace, collector: Collector
 class ActivitiesCache(Module):
     DESC = "user's activities caches"
     SPEC = [
-        ("glob", "AppData/Local/ConnectedDevicesPlatform/*/ActivitiesCache.db", from_user_home),
+        ("dir", "AppData/Local/ConnectedDevicesPlatform", from_user_home),
     ]