How to use Diskpart to list all Volumes and Partitions and output to file

Products

• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

Explain the use of a text file with Diskpart to run a script and output to a file for review

Environment

• Microsoft Windows: Windows 2000 and Higher
• Diskpart utility

Resolution

1. Connect to endpoint
2. Launch elevated command prompt
3. Run diskpart to list all volumes

   C:\>diskpart
   
   DISKPART> LIST VOLUME

4. Create script text file with the following

   LIST VOLUME

5. For each volume listed, add the following to the script text file

   SELECT VOLUME <#>
   LIST PARTITION

6. Save script text file with logical name

   Diskpart_Script.txt

7. Copy script text file to output file to record commands executed

   C:\>COPY <pathToTextFile>\Diskpart_Script.txt > <pathToOutputFile>\%COMPUTERNAME%_DiskpartOutput.txt

8. Run Diskpart using the file from step 6 as a script to output to a file

   C:\>DISKPART /S <pathToTextFile>\Diskpart_Script.txt >> <pathToOutputFile>\%COMPUTERNAME%_DiskpartOutput.txt

9. Collect Output file and provide to Support