Collects the contents of a disk drive from Windows host endpoints.
This audit was formerly known as the w32disk-acquisition audit.
This audit cannot be imported into a data acquisition script. See Audits That Cannot Be Imported on page 1.
Supported Platforms
Windows
Input Parameters
The following input parameters are available for this audit.
Path
Details | Values | Description |
|---|---|---|
Platform | Windows | Windows environments |
Format | String | Valid values are a string of text. |
Required? | yes | This parameter is required. |
Repeatable? | no | This parameter can be specified only once per audit request. It cannot be repeated. |
Valid Values | Specify the global path of the symbolic link for the disk or volume from which you want to acquire data. The trailing back-slash is optional. |
Filename
Details | Values | Description |
|---|---|---|
Platform | Windows | Windows environments |
Format | String | Valid values are a string of text. |
Required? | yes | This parameter is required. |
Repeatable? | no | This parameter can be specified only once per audit request. It cannot be repeated. |
Valid Values | Specify the name of the file for which you want to acquire data. |
offset
Details | Values | Description |
|---|---|---|
Platform | Windows | Windows environments |
Format | Numeric | Valid values are numeric. |
Required? | no | This parameter is not required. |
Repeatable? | no | This parameter can be specified only once per audit request. It cannot be repeated. |
Valid Values | Specify the offset, in bytes, from the beginning of the disk from which you want to acquire data. |
size
Details | Values | Description |
|---|---|---|
Platform | Windows | Windows environments |
Format | ByteSize | Valid values are specified in bytes. |
Required? | no | This parameter is not required. |
Repeatable? | no | This parameter can be specified only once per audit request. It cannot be repeated. |
Valid Values | Specify the size of the data acquisition, in bytes. |
Prevent Hibernation
Details | Values | Description |
|---|---|---|
Platform | Windows | Windows environments |
Format | Bool | Valid values are Boolean values. |
Required? | no | This parameter is not required. |
Repeatable? | no | This parameter can be specified only once per audit request. It cannot be repeated. |
Valid Values | Use Boolean values to indicate whether to prevent the host endpoint from entering hibernation while this audit is executed. |