RxODE (version 0.9.0-8)

rxPhysicalDrives: Returns a list of physical drives that have been or currently are mounted to the computer.

Description

This excludes network drives. See https://www.forensicmag.com/article/2012/06/windows-7-registry-forensics-part-5

Usage

rxPhysicalDrives(duplicates = FALSE)

Arguments

duplicates

Return drives with duplicate entires in SYSTEM\MountedDevices; These are likely removable media. By default this is FALSE

Value

Drives with letters