Skip to content

Instantly share code, notes, and snippets.

@anderssonjohan
Created February 26, 2021 14:23
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save anderssonjohan/482ef06f5b40fc1c36c7d4f2ac1a107b to your computer and use it in GitHub Desktop.
Save anderssonjohan/482ef06f5b40fc1c36c7d4f2ac1a107b to your computer and use it in GitHub Desktop.
Script to enumerate filesystem info for the volumes collected by metricbeat, which stopped working from version 7.11

Metricbeat fails using version 7.11 when GetVolumeInformationW returns false, which it does for floppy and cd-rom volumes.

Example output from this script:

PS> get-volumeinformation.ps1
Drives found by GetLogicalDriveStringsW: A:\ C:\ D:\ L:\
GetVolumeInformationW for A:\ returned False
A:\ volume name:
A:\ filesystem name:
GetVolumeInformationW for C:\ returned True
C:\ volume name:
C:\ filesystem name: NTFS
GetVolumeInformationW for D:\ returned False
D:\ volume name:
D:\ filesystem name:
GetVolumeInformationW for L:\ returned True
L:\ volume name: Logs
L:\ filesystem name: NTFS
$pinvokes = @'
[DllImport("Kernel32.dll", CharSet = CharSet.Auto, SetLastError = true)]
[return: MarshalAs(UnmanagedType.Bool)]
public extern static bool GetVolumeInformationW(
string rootPathName,
System.Text.StringBuilder volumeNameBuffer,
int volumeNameSize,
out uint volumeSerialNumber,
out uint maximumComponentLength,
out uint fileSystemFlags,
System.Text.StringBuilder fileSystemNameBuffer,
int nFileSystemNameSize);
[DllImport("Kernel32.dll", CharSet = CharSet.Auto, SetLastError = true)]
public static extern uint GetLogicalDriveStringsW(uint nBufferLength, [Out] char[] lpBuffer);
'@
$Kernel32 = Add-Type -MemberDefinition $pinvokes -Name 'Kernel32' -Namespace 'Win32' -PassThru
$drives = [char[]]::new(512)
$Kernel32::GetLogicalDriveStringsW($drives.length, $drives) | out-null
$drives = (new-object System.String(,$drives))
$drives = $drives.Split("`0", [System.StringSplitOptions]::RemoveEmptyEntries)
Write-Host "Drives found by GetLogicalDriveStringsW: $drives"
$drives | %{
$volumeNameBuffer = New-Object -TypeName "System.Text.StringBuilder"
$fileSystemNameBuffer = New-Object -TypeName "System.Text.StringBuilder"
$res = $Kernel32::GetVolumeInformationW($_, $volumeNameBuffer, 255, [ref]0, [ref]0, [ref]0, $fileSystemNameBuffer, 255)
Write-Host "GetVolumeInformationW for $_ returned $res"
Write-Host "$_ volume name: $($volumeNameBuffer.ToString())"
Write-Host "$_ filesystem name: $($fileSystemNameBuffer.ToString())"
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment