This is a free utility to take an inventory of drives attached to a PC running Windows.   It can be run from a removable drive, and will make a file name based on the name of the PC, and list out all the drives and related information about them.

This can be used to inventory all of the windows PC’s during a collection to make sure all drives have been copied.

It currently written in C# requires Microsoft .NET to be installed on the PC.   We are working on a c++ version that will not require this.   The next version will also have an option to invoke robocopy and generate a file listing and/or copy the drive to current drive.

Contact us at support@ediscoverysquad.com to register for updates.

For more about robocopy see our http://ediscoverysquad.com/how-to

Here is an example of the output of this program.

You can get a copy of the program here:

http://ediscoverysquad.com/files/DiskFinder.zip

This programe is being run from: C:UsersJeffDesktopDiskFinder (2)DiskFinderbinDebug

Computer Name: JEFF-PC
Number of Drives: 6
Drive – C:
Drive Type: Fixed
Drive Ready Status: True
Volume Label: Boot Drive
File System Type : NTFS
Free Space: 30021926912
Total Drive Size: 240055742464

Drive – D:
Drive Type: Fixed
Drive Ready Status: True
Volume Label: Application Data
File System Type : NTFS
Free Space: 42462507008
Total Drive Size: 240054693888

Drive – E:
Drive Type: Fixed
Drive Ready Status: True
Volume Label: Output Processing
File System Type : NTFS
Free Space: 75996823552
Total Drive Size: 480101003264

Drive – F:
Drive Type: Fixed
Drive Ready Status: True
Volume Label: Temporary File Storage
File System Type : NTFS
Free Space: 50895007744
Total Drive Size: 500104687616

Drive – G:
Drive Type: Fixed
Drive Ready Status: True
Volume Label: Output Processing Drive 2
File System Type : NTFS
Free Space: 144843849728
Total Drive Size: 480101003264

Drive – H:
Drive Type: CDRom
Drive Ready Status: True
Volume Label: F9L1002v1
File System Type : UDF
Free Space: 0
Total Drive Size: 57573376

Here is the source code for the program:

/*

* copyright (c) 2012, 2013, eDiscoverySquad, LLC.
* All Rights Reserved
*
* Date created: December 23rd, 2012
*
* DiskFinder.cs
*
* Author(s): Paul Aquino, Jeffrey Goodwin
*
*
*
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Library General Public
* License as published by the Free Software Foundation; either
* version 2 of the License, or (at your option) any later version.
*
* This library is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* Library General Public License for more details.
*
*
* Notwithstanding the foregoing, you must:
*
* a) register to use this software by sending an email to: support@ediscoverysquad.com, and include the site description of where the software will be used
*
* b) Maintain eDiscoverySquad, LLC copyright notice and credit for the user of the program
*
* In order to use the program, you need to download Microsoft .NET 3.5 or later. Note, that we are working on a version of this program which does not require Microsoft .NET.
* Please contact us if you need this version.
*
*/

using System;
using System.IO;
/*
<summary>
A console program that is intended to run from an external drive which is attached to a PC. The program will record system information including the following:
* The computer name
* The number of drives in the system
* The file system type for each drive
* The properties of each drive, e.g., size, number of files, and space allocation
*
</summary>
*/
public class DiskFinder
{

/* <summary>
* The programs’ central point of control.
* There are no input arguments.
* </summary>
*/

public static void Main(string[] args)
{
/*
* Get computer drives info. This builds an array that contains the total number of drives, and characterizes the type of file system on each drive.
*
*/

DriveInfo[] mySystemDrives = DriveInfo.GetDrives();

/*
* Write the Drive Information to the output file
*/

WriteDrives(mySystemDrives);

} /* end of program */
/* <summary>

* WriteDrive method writes local drives information to the text file.

* Input Parameter: <param name=”my_driv”> Array of type DriveInfo that represents the logical drives on a computer.</param>

* Return Value: None

* </summary>

*/

public static void WriteDrives(DriveInfo[] my_driv)
{

/*
* Define output file name listing to be concatenated to computer name for the purpose of output file naming convention
*/
string OutputFileListingSuffix = ” DriveListing.txt”;

/*
* Define Text Labels to be used for entries written to the information file listing
*/

string DriveIDLabel = “Drive – “;
string FileSystemTypeLabel = “File System Type : “;
string ComputerNameLabel = “Computer Name: “;
string NumberofDrivesLabel = “Number of Drives: “;
string DriveTypeLabel = “Drive Type: “;
string VolumeLabel = “Volume Label: “;
string FreeSpaceLabel = “Free Space: “;
string TotalDriveSizeLabel = “Total Drive Size: “;
string CurrentDriveLabel = “This programe is being run from: “;
string IsReadyLabel = “Drive Ready Status: “;

/*
* Set up and open target text file. Replace pathName in StreamWriter(“pathName”) to your target text file.
*/
System.IO.StreamWriter targetFile = new System.IO.StreamWriter(Environment.MachineName + OutputFileListingSuffix);
/*
* Write current drive and directory to output file
*/

targetFile.WriteLine(CurrentDriveLabel + Environment.CurrentDirectory);

/*
* Writing local computer name and number of local drives.
*/
targetFile.WriteLine(ComputerNameLabel + Environment.MachineName);

targetFile.WriteLine(NumberofDrivesLabel + my_driv.Length);
/*
* put an extra line between each drive information listing
*/

targetFile.WriteLine(“n”);

/*
* Traverses each drive in the drives array and writes drive name and format to results.txt.
*/

foreach (DriveInfo d in my_driv)
{
try
{
/*
* Write the Drive Name
*/

targetFile.WriteLine(DriveIDLabel + d.Name);

/*
* Write the Drive Type, e.g. Fixed, DVD, etc.
*/

targetFile.WriteLine(DriveTypeLabel + d.DriveType);

/*
* Is Ready Status
*/

targetFile.WriteLine(IsReadyLabel + d.IsReady);

/*
* Write the Volume Label
*/

targetFile.WriteLine(VolumeLabel + d.VolumeLabel);
/*
* Write the File System Type, e.g. NTFS, FAT, UDF (DVD drive)
*/

targetFile.WriteLine(FileSystemTypeLabel + d.DriveFormat);
/*
* Write the drive space information
*/

targetFile.WriteLine(FreeSpaceLabel + d.TotalFreeSpace);

targetFile.WriteLine(TotalDriveSizeLabel + d.TotalSize);
/*
* put an extra line between each drive information listing
*/

targetFile.WriteLine(“n”);
}
catch {
targetFile.WriteLine(“exception encountered”);
}
} /* end for */

/*
* close the file handle
*/

targetFile.Close();

} /* end of WriteDrives() */
} /* end of DiskFinder class */

The post Free Utility to get an Inventory of Drives attached to a PC, includes source code appeared first on eDiscoverySquad Litigation Support Services.

In my prior company (life) we developed intellectual property for operating systems primitives in windows, and network security protocols such as IPSec (Internet Protocol Security), e.g. VPN.   We had “bake-off’s” sponsored by the IETF (Internet Engineering Task Force) that blesses all of the standards that make up the Internet, to prove the worthiness of the security protocols in a way that was open to the most sophisticated cryptologists and hackers in the world.

Similarly, the legal argument for open source eForensics is a good one in that provides transparency to these experts to examine and soundness of the algorithms, operating system primitives, network protocols, and crypto libraries used to produce digital evidence.

This type of scrutiny will never be obtained in a closed and proprietary system.

This paper from Brian Carrier from Purdue University, lays out the legal argument for the use of open source tools in the field of eDiscovery and eForensics by applying “Daubert” guidelines.

Open Source Legal Argument for eForensics and eDiscovery

In Mr. Carrier’s paper, he discuss the major concepts in eForensics as they apply to eDiscovery :

Acquistion, Analysis, and Presentation.

The analysis phase includes:

- Inculpatory Evidence: That which supports a given theory ( e.g., emperical log files that show Volume Serial ID’s of each hard drive, complete discovery of the the file system, disposition of each file extracted/copied)

- Exculpatory Evidence: That which contradicts a given theory (e.g., shows that data acquistion was not properly performed)

- Evidence of tampering: That which can not be related to any theory, but shows
that the system was tampered with to avoid identification (e.g., spoliation)

In terms of admissibility of evidence, The Daubert process identifies four general categories that are used as guidelines when assessing a procedure:

- Testing: Can and has the procedure been tested?
- Error Rate: Is there a known error rate of the procedure?
- Publication: Has the procedure been published and subject to peer review?
- Acceptance: Is the procedure generally accepted in the relevant scientific
community?

Just as there is a “Chain of Custody”, that produces log files at the point of origin to log all of the data to be captured and it’s disposition, subsequent verification and encryption — there is also a similar set of analysis to show the operating system primitives that are called to produce this chain of custody.

These points of reference lay the groundwork for defensible eForensic tools not only for data acquisition, but also for eDiscovery processing, searching, culling, and file transformations for productions to opposing counsel.

We welcome your input on this discussion.

Jeffrey Goodwin
Founder, eDiscoverySquad, LLC

The post The Legal Argument for Open Source eForensics & eDiscovery appeared first on eDiscoverySquad Litigation Support Services.