SCSI Info
Overview
Section titled “Overview”Evidence: SCSI Info
Description: ESXi SCSI Info
Category: DiskFilesystem
Platform: esxi
Short Name: scsiinfo
Is Parsed: Yes
Sent to Investigation Hub: Yes
Collect File(s): No
Background
Section titled “Background”SCSI storage devices and adapters connect ESXi hosts to local and remote storage systems. SCSI device inventory reveals storage topology, LUN mappings, and adapter configurations that are essential for understanding data storage architecture and detecting unauthorized storage access.
Data Collected
Section titled “Data Collected”This collector gathers structured data about scsi info.
SCSI Info Data
Section titled “SCSI Info Data”| Field | Description | Example |
|---|---|---|
DeviceType | Device Type | Example value |
Size | Size | Example value |
DisplayName | Display Name | Example value |
MultipathPlugin | Multipath Plugin | Example value |
ConsoleDevice | Console Device | Example value |
DevfsPath | Devfs Path | Example value |
Vendor | Vendor | Example value |
Model | Model | Example value |
Revision | Revision | Example value |
SCSILevel | SCSI Level | Example value |
IsPseudo | Is Pseudo | Example value |
Status | Status | Example value |
IsRDMCapable | Is RDM Capable | Example value |
IsRemovable | Is Removable | Example value |
IsLocal | Is Local | Example value |
IsSSD | Is SSD | Example value |
OtherNames | Other Names | Example value |
VAAIStatus | VAAI Status | Example value |
Collection Method
Section titled “Collection Method”This collector parses SCSI device information, extracting device names, adapter types, target IDs, LUN numbers, vendor identifiers, product information, device sizes, and operational states for each SCSI device visible to the ESXi host.
Forensic Value
Section titled “Forensic Value”SCSI configuration analysis helps identify unauthorized LUN presentations, detect rogue storage devices, validate storage security configurations, and trace data access paths. Unexpected SCSI devices or LUN changes may indicate storage-based data exfiltration attempts or unauthorized backup access.