1 year ago

#68851

test-img

woeile

Get only external disks in Powershell, even if external device identifies itself as SCSI-device

I am trying to display information about partitions of external drives in a Powershell script. Obviously I searched and found a gwmi query on Stack Overflow:

gwmi win32_diskdrive | ?{$_.interfacetype -eq "USB" -or "SCSI"} | ?{$_.DeviceID -ne "\\.\PHYSICALDRIVE0"} | %{gwmi -Query "ASSOCIATORS OF {Win32_DiskDrive.DeviceID=`"$($_.DeviceID.replace('\','\\'))`"} WHERE AssocClass = Win32_DiskDriveToDiskPartition"} |  %{gwmi -Query "ASSOCIATORS OF {Win32_DiskPartition.DeviceID=`"$($_.DeviceID)`"} WHERE AssocClass = Win32_LogicalDiskToPartition"} | %{$_.deviceid}

I have been able to add some code to show more info on individual partitions (volume name, model name of disk) based on the input of this script. The problem with the original query was that my external USB Type C SSD that presents itself as SCSI device was not found with this query. So I added SCSI to the interfacetype property. This created a new problem; the actual internal SSD was displayed. So I manually excluded this by excluding PhysicalDrive0. Which obviously is an ugly solution. One of the problems this might cause is that a second internal drive could show up.

I started to look for different solutions. One I found was the Get-Disk cmdlet, which can filter on bustype. This works the way I want to. So I got inspired to look up the corresponding property for Win32_DiskDrive. Which wasn't there :( Get-Disk only works on W8 and higher and unfortunately I need it to work on W7 too. No modification on the W7 system allowed. So My actual question is, how can I separate external disks from internal ones with gwmi queries, such that my external USB Type C SCSI disk is found but the internal SCSI SSD is not? Further search queries from my side didn't get me the results I was looking for.

Edit: I found a note by myself that might have been a solution but I get some unexpected behaviour.

gwmi win32_diskdrive | Where-Object {$_.MediaType -Match "Removable media" -or "External hard disk media"}

Also gets the internal drive, which is weird as there is a MediaType called "Internal hard disk media". Even weirder, in both these queries I DON'T get the internal SSD in the results:

gwmi win32_diskdrive | Where-Object {$_.MediaType -Match "Removable media"}

gwmi win32_diskdrive | Where-Object {$_.MediaType -Match "External hard disk media"}

I really don't get why seperate queries don't return the internal SSD, while combined with an -or operator the internal SSD does get returned....

powershell

computer-forensics

0 Answers

Your Answer

Accepted video resources