Extracting Windows system information with the wmi_info() function

The wmi_info() function, defined on line 172, starts by defining a dictionary that will store the various types of information we query using the WMI API.

Similarly, on line 185, we create the WMI object and assign it to the variable, conn, which is what we will be specifically querying:

172 def wmi_info(outdir):173     """174     Gather information available through Windows Management175     Interface. We recommend extending this script by adding176     support for other WMI modules -- Win32_PrintJob,177     Win32_NetworkAdapterConfiguration, Win32_Printer,178     Win32_PnpEntity (USB).179     :param outdir: The directory to write CSV reports to.180     :return: Nothing.181     """182 183 wmi_dict = {"Users": ...

Get Learning Python for Forensics - Second Edition now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.