Hard Drive Audit - windows - superseded
Log In or Register to download the BES file, and more.

0 Votes

Versioning - This is an older version.

1Hard Drive Audit - Windows11/29/2012 10:26:19 AM
2Hard Drive Audit - windows12/10/2012 1:21:27 PM
3Hard Drive Audit - windows12/11/2012 7:40:03 AM
4Hard Drive Audit - windows1/18/2013 11:02:12 AM
5Hard Drive Audit - windows5/28/2013 10:41:22 AM
6Hard Drive Audit - windows6/4/2013 11:24:20 AM
7Hard Drive Audit - Windows6/28/2013 6:33:09 AM
8Hard Drive Audit - Windows12/6/2013 8:22:24 AM
9Hard Drive Audit - Windows8/8/2014 1:12:29 PM
10Hard Drive Audit - Windows8/15/2014 12:30:58 PM

Description

Total Used Space of System Drive

Property Details

ID2994527
TitleHard Drive Audit - windows
DomainBESC
Added by on 6/4/2013 11:24:20 AM
Last Modified by on 6/4/2013 11:24:20 AM
Counters 5120 Views / 2 Downloads
User Rating 1 star 2 star 3 star 4 star 5 star * Average over 0 ratings. ** Log In or Register to add your rating.

Properties

Total Used Space of System Drive
Period 6 hours
 
  * Results in a "string"/number
Show indented relevance
(((total space of drive of system folder)/(1024 * 1024 * 1024)) - ((free space of drive of system folder)/(1024 * 1024 * 1024))) as string & " GB"
Total Free Space of System Drive
Period 6 hours
 
  * Results in a "string"/number
Show indented relevance
((free space of drive of system folder)/(1024 * 1024 * 1024)) as string & " GB"
Partitions 4k aligned?
Period 1 day
 
  * Results in a "string"/number
Show indented relevance
not disjunction of ((following text of first "=" of (property "StartingOffset" of it as string) as integer mod 4096) != 0) of select objects "* from Win32_DiskPartition" of wmi
Partition Block Size
Period 2 days
 
  * Results in a "string"/number
Show indented relevance
concatenation "," of unique values of (following text of first "=" of (property "BlockSize" of it as string)) of select objects "* from Win32_DiskPartition" of wmi
Size of PageFile?
Period 1 day
 
  * Results in a "string"/number
Show indented relevance
((size of file "c:\pagefile.sys")/(1024 * 1024)) as string
Size of Dell folder?
Period 2 days
 
  * Results in a "string"/number
Show indented relevance
if exists (folder "dell" of drive of system folder) then ((sum of sizes of descendants of folder "dell" of drive of system folder) / (1024 * 1024)) as string else "<none>"
Drive Firmware
Period 7 days
 
  * Results in a "string"/number
Show indented relevance
if (exists wmi) then (concatenation "; " of ((string value of property "Model" of it, string value of property "FirmwareRevision" of it) of select objects "Model, FirmwareRevision from Win32_DiskDrive" of wmi as string)) else "n/a"
% Free Space
Period 6 hours
 
  * Results in a true/false
Show indented relevance
(free space of drive of system folder)*100/(total space of drive of system folder)
Hard Drive Serial Numbers
Period 7 days
 
  * Results in a true/false
Show indented relevance
if (exists wmi) then (concatenation ", " of (((substrings after "=" whose(it as trimmed string != "") of (property "SerialNumber" of it as string)) of select objects "* from win32_PhysicalMedia where SerialNumber != ''" of wmi) as trimmed string)) else "n/a"
Size of Temp folder?
Period 1 day
 
  * Results in a true/false
Show indented relevance
if exists (folder "temp" of drive of system folder) then ((sum of sizes of descendants of folder "temp" of drive of system folder) / (1024 * 1024)) as string else "<none>"
PredictFailure?
Period 1 day
 
  * Results in a true/false
Show indented relevance
if(not exists (select objects "* from MSStorageDriver_FailurePredictStatus" of wmi "root\WMI") whose(string value of property "PredictFailure" of it as boolean = TRUE)) then "<no failures predicted>" else concatenation "," of (string value of property "PredictFailure" of it & " - " & string value of property "InstanceName" of it) of (select objects "* from MSStorageDriver_FailurePredictStatus" of wmi "root\WMI") whose(string value of property "PredictFailure" of it as boolean = TRUE)
Size of HiberFil?
Period 1 day
 
  * Results in a true/false
Show indented relevance
if(not exists file "c:\hiberfil.sys") then nothing else ((size of file "c:\hiberfil.sys")/(1024 * 1024)) as string
TRIM disabled?
Period 6 hours
 
  * Results in a true/false
Show indented relevance
value "DisableDeleteNotification" of key "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\FileSystem" of native registry
Size of TEM dl cache
Period 1 day
 
  * Results in a true/false
Show indented relevance
if exists (folder "__BESData\__Global\__Cache\Downloads" of parent folder of regapp "Besclient.exe") then ((sum of sizes of descendants of folder "__BESData\__Global\__Cache\Downloads" of parent folder of regapp "Besclient.exe") / (1024 * 1024)) as string & " mb" else ERROR "none"
Space of Drives
Period 6 hours
 
  * Results in a true/false
Show indented relevance
(name of it & " - Size: " & ((total space of it /(1024*1024*1024)) as string & " GB") & ", Used:(" & (((total space of it - free space of it)*100/(total space of it)) as string) & ") " & (((total space of it - free space of it) /(1024*1024*1024)) as string & " GB") & ", Free:(" & (((free space of it)*100/(total space of it)) as string) & ") "& ((free space of it /(1024*1024*1024)) as string & " GB")) of drives whose(exists name of it AND exists free space of it AND type of it = "DRIVE_FIXED")

Relevance

isWindows (Relevance 1172)
Used in 1155 fixlets and 538 analyses   * Results in a true/false
Show indented relevance
windows of operating system
Used in 2 fixlets and 23 analyses   * Results in a true/false
Show indented relevance
exists wmi

Sharing

Social Media:
Share this page on Yammer

Comments

Log In or Register to leave comments!