Lab 9a Scripting Practice
@echo off
REM This script will collect volatile information from a Windows system.
:TKT
set /p TKTNUM=What is the ticket number for this report? (e.g. 0001):
ECHO You entered: "%TKTNUM%"
set /p CHKTKT=Is this correct? (y/n)
If /i "%CHKTKT%"=="n" goto :TKT
cls
:USR
set /p USRNAME=Enter the userID authenticated at the time of the incident (e.g. bmookie):
ECHO You entered: "%USRNAME%"
set /p USR=Is this correct? (y/n)
If /i "%USR%"=="n" goto :USR
cls
REM Create location to save results
mkdir %TKTNUM%-%COMPUTERNAME%-Results
set resultsDir=%TKTNUM%-%COMPUTERNAME%-Results
REM Run commands to collect system information.
echo "Collecting Running Processes"
tasklist /svc /FO CSV > "%resultsDir%\tasklist.csv"
echo "Collecting network statistics"
netstat -an > "%resultsDir%\netstat.txt"
echo "Collecting contents of the C Directory"
tree /A C:\ > "%resultsDir%\TreeList.txt"
REM Too much work to figure out how to get the file naming right
REM FILE=C:\Users\champuser\Downloads\0001-DESKTOP-P1PH8V7-Results
REM if test -f "$FILE"; then
REM echo "$FILE exists."
echo "Getting the information of the system."
systeminfo > "%ResultsDir%\Systeminfo.txt"
echo "Script Finished :)"
Last updated