[SOLVED] tis-audit-bitlocker, external hard drive

[Olivier Schmitt]

Good morning,

https://wapt.tranquil.it/store/fr/tis-audit-bitlocker

I have noticed a number of false positives when an external USB hard drive is plugged in.

Indeed, to exclude them you use:

Code: Select all

 if run_powershell("Get-Volume -DriveLetter %s | Where-Object DriveType -EQ Removable" % mountpoint.replace(":", "")):

Here is an example of a false positive:

Code: Select all

Get-Volume -DriveLetter E

DriveLetter FriendlyName FileSystemType DriveType HealthStatus OperationalStatus SizeRemaining      Size
----------- ------------ -------------- --------- ------------ ----------------- -------------      ----
E           FREECOM      FAT32          [b]Fixed     [/b]Healthy      OK                    536.38 GB 931.28 GB

You could also potentially base your decision on the bus type:

Code: Select all

if run_powershell("(Get-PhysicalDisk | Where-Object BusType -EQ USB | ForEach-Object { Get-Disk -Number $_.DeviceId | Get-Partition | Get-Volume } | Where-Object DriveLetter -EQ '%s').DriveLetter -ne $null" % mountpoint.replace(":", ""))

Sincerely,

[jlepiquet]

Hello Olivier,

Thank you for this concrete example. We will look into integrating the code you shared. This will improve the package by excluding even more external drives.

Best regards,