getWinDump.ps1

[Console]::TreatControlCAsInput = $true

function Rotate-files
{
	Param ([int]$processNumber)

	while ((Get-ChildItem  -Recurse -Include capture_*.pcap -Path C:\lapi_logs\).Count -gt 5)
	{
		(Get-ChildItem  -Recurse -Include capture_*.pcap -Path C:\lapi_logs\ | Select-Object -First 1).Delete()
	}

	if (Test-Path -Path "C:\lapi_logs\capture$processNumber.pcap")
	{
		$_date = date -Format ddMMyyhhmmss
		move "C:\lapi_logs\capture$processNumber.pcap" "C:\lapi_logs\capture_$_date.pcap"
	}

	if ($processNumber -eq 0) { $newProcess = 1 } else { $newProcess = 0 }
	Init-Process -logActive $newProcess
}

function Init-Process
{
	Param ([int]$logActive)

	if ($logActive -eq 0) { $nextProcess = 1 } else { $nextProcess = 0 }
	$command = "C:\Users\silvio.silva\WinDump.exe -s0 -U -w C:\lapi_logs\capture$nextProcess.pcap"
	$scriptBlock = [scriptblock]::Create($command)
	Start-Job -Name "Pcap$nextProcess" -ScriptBlock $scriptBlock

	Stop-Job -Name "Pcap$logActive" -ea SilentlyContinue
	Remove-Job -Name "Pcap$logActive" -ea SilentlyContinue

	Start-Sleep -Milliseconds 2000
	while ((Get-Item -Path "C:\lapi_logs\capture$nextProcess.pcap").length / 1GB -lt 1) { Start-Sleep -Milliseconds 100 }
	Rotate-Files -processNumber $logActive
}

Init-Process -logActive 0