param(
  [string]$BackupPath = "\\kallilabcore\backups\windows-images\baerchen",
  [string]$JobName = "baerchen-c-image",
  [string]$LogRoot = "C:\ProgramData\Veeam\Endpoint"
)

$ErrorActionPreference = "Stop"

function Write-Section {
  param([string]$Title)
  Write-Host ""
  Write-Host "== $Title =="
}

$result = [ordered]@{
  ComputerName = $env:COMPUTERNAME
  Timestamp = (Get-Date).ToString("s")
  JobName = $JobName
  BackupPath = $BackupPath
  VeeamService = $null
  BackupPathReachable = $false
  BackupFiles = @()
  LatestBackupFile = $null
  LatestJobEvidence = @()
}

Write-Section "Veeam service"
$service = Get-Service -Name VeeamEndpointBackupSvc -ErrorAction SilentlyContinue
if ($service) {
  $result.VeeamService = $service.Status.ToString()
  $service | Select-Object Status,Name,DisplayName | Format-Table -AutoSize
} else {
  $result.VeeamService = "missing"
  Write-Warning "VeeamEndpointBackupSvc not found"
}

Write-Section "Backup target"
if (Test-Path -LiteralPath $BackupPath) {
  $result.BackupPathReachable = $true
  $files = Get-ChildItem -LiteralPath $BackupPath -File -Recurse |
    Sort-Object LastWriteTime -Descending |
    Select-Object FullName,Length,LastWriteTime
  $result.BackupFiles = $files
  $result.LatestBackupFile = $files | Select-Object -First 1
  $files | Select-Object -First 20 | Format-Table -AutoSize
} else {
  Write-Warning "Backup path is not reachable from this Windows session. This can be normal when Veeam uses stored job credentials and the interactive user has no active SMB session."
}

Write-Section "Veeam job evidence"
if (Test-Path -LiteralPath $LogRoot) {
  $logFiles = @(
    (Join-Path $LogRoot "Svc.VeeamEndpointBackup.log"),
    (Join-Path $LogRoot "UI.BackupJobWizard.log"),
    (Join-Path $LogRoot "UI.Tray-michi.log")
  ) | Where-Object { Test-Path -LiteralPath $_ }

  $patterns = @(
    [regex]::Escape("Job [$JobName] was started"),
    'Session result: "Success", job type: "EndpointBackup"',
    [regex]::Escape("Name: [$JobName]"),
    'Result: \[Success\]',
    'StorageEncryptionEnabled:\s+0',
    [regex]::Escape("Starting endpoint backup, job name = $JobName")
  ) -join "|"

  $evidence = Select-String -Path $logFiles -Pattern $patterns -CaseSensitive:$false -ErrorAction SilentlyContinue |
    Sort-Object Path,LineNumber |
    Select-Object -Last 30 @{Name = "File"; Expression = { Split-Path -Leaf $_.Path } },LineNumber,Line
  $result.LatestJobEvidence = $evidence
  $evidence | Format-List

  if (-not ($evidence | Where-Object { $_.Line -match 'Result: \[Success\]|Session result: "Success"' })) {
    Write-Warning "No successful EndpointBackup session was found in the selected Veeam logs."
  }
} else {
  Write-Warning "Veeam log root not found: $LogRoot"
}

Write-Section "Summary"
[pscustomobject]$result | Select-Object ComputerName,Timestamp,JobName,BackupPath,VeeamService,BackupPathReachable,LatestBackupFile | Format-List