Hard Drive Audit - windows - superseded
Log In or Register to download the BES file, and more.

2 Votes

Versioning - This is an older version.

1Hard Drive Audit - Windows11/29/2012 10:26:19 AM
2Hard Drive Audit - windows12/10/2012 1:21:27 PM
3Hard Drive Audit - windows12/11/2012 7:40:03 AM
4Hard Drive Audit - windows1/18/2013 11:02:12 AM
5Hard Drive Audit - windows5/28/2013 10:41:22 AM
6Hard Drive Audit - windows6/4/2013 11:24:20 AM
7Hard Drive Audit - Windows6/28/2013 6:33:09 AM
8Hard Drive Audit - Windows12/6/2013 8:22:24 AM
9Hard Drive Audit - Windows8/8/2014 1:12:29 PM
10Hard Drive Audit - Windows8/15/2014 12:30:58 PM

Description

Total Used Space of System Drive

Property Details

ID2994520
StatusQA - Ready for Production Level Testing
TitleHard Drive Audit - windows
DomainBESC
Added by on 5/28/2013 10:41:22 AM
Last Modified by on 5/28/2013 10:41:22 AM
Counters 5108 Views / 7 Downloads
User Rating 1 star 2 star 3 star 4 star 5 star * Average over 2 ratings. ** Log In or Register to add your rating.

Properties

Total Used Space of System Drive
Period 6 hours
 
  * Results in a "string"/number
Show indented relevance
(((total space of drive of system folder)/(1024 * 1024 * 1024)) - ((free space of drive of system folder)/(1024 * 1024 * 1024))) as string & " GB"
Total Free Space of System Drive
Period 6 hours
 
  * Results in a "string"/number
Show indented relevance
((free space of drive of system folder)/(1024 * 1024 * 1024)) as string & " GB"
Partitions 4k aligned?
Period 1 day
 
  * Results in a "string"/number
Show indented relevance
not disjunction of ((following text of first "=" of (property "StartingOffset" of it as string) as integer mod 4096) != 0) of select objects "* from Win32_DiskPartition" of wmi
Partition Block Size
Period 2 days
 
  * Results in a "string"/number
Show indented relevance
concatenation "," of unique values of (following text of first "=" of (property "BlockSize" of it as string)) of select objects "* from Win32_DiskPartition" of wmi
Size of PageFile?
Period 1 day
 
  * Results in a "string"/number
Show indented relevance
((size of file "c:\pagefile.sys")/(1024 * 1024)) as string
Size of Dell folder?
Period 2 days
 
  * Results in a "string"/number
Show indented relevance
if exists (folder "dell" of drive of system folder) then ((sum of sizes of descendants of folder "dell" of drive of system folder) / (1024 * 1024)) as string else "<none>"
Drive Firmware
Period 7 days
 
  * Results in a "string"/number
Show indented relevance
if (exists wmi) then (concatenation "; " of ((string value of property "Model" of it, string value of property "FirmwareRevision" of it) of select objects "Model, FirmwareRevision from Win32_DiskDrive" of wmi as string)) else "n/a"
% Free Space
Period 6 hours
 
  * Results in a true/false
Show indented relevance
(free space of drive of system folder)*100/(total space of drive of system folder)
Hard Drive Serial Numbers
Period 7 days
 
  * Results in a true/false
Show indented relevance
if (exists wmi) then (concatenation ", " of (((substrings after "=" whose(it as trimmed string != "") of (property "SerialNumber" of it as string)) of select objects "* from win32_PhysicalMedia where SerialNumber != ''" of wmi) as trimmed string)) else "n/a"
Size of Temp folder?
Period 1 day
 
  * Results in a true/false
Show indented relevance
if exists (folder "temp" of drive of system folder) then ((sum of sizes of descendants of folder "temp" of drive of system folder) / (1024 * 1024)) as string else "<none>"
PredictFailure?
Period 1 day
 
  * Results in a true/false
Show indented relevance
if(not exists (select objects "* from MSStorageDriver_FailurePredictStatus" of wmi "root\WMI") whose(string value of property "PredictFailure" of it as boolean = TRUE)) then "<no failures predicted>" else concatenation "," of (string value of property "PredictFailure" of it & " - " & string value of property "InstanceName" of it) of (select objects "* from MSStorageDriver_FailurePredictStatus" of wmi "root\WMI") whose(string value of property "PredictFailure" of it as boolean = TRUE)
Size of HiberFil?
Period 1 day
 
  * Results in a true/false
Show indented relevance
if(not exists file "c:\hiberfil.sys") then nothing else ((size of file "c:\hiberfil.sys")/(1024 * 1024)) as string
TRIM disabled?
Period 6 hours
 
  * Results in a true/false
Show indented relevance
value "DisableDeleteNotification" of key "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem" of native registry
Size of TEM dl cache
Period 1 day
 
  * Results in a true/false
Show indented relevance
if exists (folder "__BESData\__Global\__Cache\Downloads" of parent folder of regapp "Besclient.exe") then ((sum of sizes of descendants of folder "__BESData\__Global\__Cache\Downloads" of parent folder of regapp "Besclient.exe") / (1024 * 1024)) as string & " mb" else ERROR "none"

Relevance

isWindows (Relevance 1172)
Used in 1155 fixlets and 538 analyses   * Results in a true/false
Show indented relevance
windows of operating system
Used in 2 fixlets and 23 analyses   * Results in a true/false
Show indented relevance
exists wmi

Sharing

Social Media:
Share this page on Yammer

Comments

Log In or Register to leave comments!
jgstew -
I've updated it here: http://bigfix.me/cdb/analysis/2994520
jgstew -
Good catch. I did copy and paste the dell relevance and then modify it, but it seems I missed that. I'll correct that soon.
kerryt9455 -
The "Size of TEM dl cache" has an error in it. Believe it was copied from the Dell folder size above. It should check to see if the TEM dl cache folder exists rather than the dell folder.