Windows Gather Physical Drives and Logical Volumes
This module will list physical drives and logical volumes
Rank
- Normal
Authors
- Wesley McGrew < wesley [at] mcgrewsecurity.com >
Development
Similar Modules
- post/windows/gather/forensics/duqu_check
- post/windows/gather/forensics/imager
- post/windows/gather/forensics/nbd_server
Usage Information
$ msfconsole
## ### ## ##
## ## #### ###### #### ##### ##### ## #### ######
####### ## ## ## ## ## ## ## ## ## ## ### ##
####### ###### ## ##### #### ## ## ## ## ## ## ##
## # ## ## ## ## ## ## ##### ## ## ## ## ##
## ## #### ### ##### ##### ## #### #### #### ###
##
msf > use post/windows/gather/forensics/enum_drives
msf post(enum_drives) > set SESSION [INTEGER]
## ### ## ##
## ## #### ###### #### ##### ##### ## #### ######
####### ## ## ## ## ## ## ## ## ## ## ### ##
####### ###### ## ##### #### ## ## ## ## ## ## ##
## # ## ## ## ## ## ## ##### ## ## ## ## ##
## ## #### ### ##### ##### ## #### #### #### ###
##
msf > use post/windows/gather/forensics/enum_drives
msf post(enum_drives) > set SESSION [INTEGER]
Module Options
| MAXDRIVES | Maximum physical drive number (default: 10) |
| SESSION | The session to run this module on. |
| VERBOSE | Enable detailed status messages |
| WORKSPACE | Specify the workspace for this module |
