diskpart.exe

  • File Path: C:\Windows\system32\diskpart.exe
  • Description: DiskPart

Hashes

Type Hash
MD5 07B2CEDAADC8202D201A1E8552737BE9
SHA1 EEF86A653F127486C5D1E1468D85CDE2653316BE
SHA256 BFD5377E93863AA5CCC8233C09BE14C54CE7731062CBA5BD319B2A1E2955EA1D
SHA384 A0EF0E5F8A2ED394EF0F21498171678175DEA8EC6756A41CC534D4FD762FACDB3E007F839C913FD2642875530C27AA92
SHA512 F7ECB3946F90DA26B78D7DF0777CD95A66D03582E7F3FDAD4B4B724EC4A8A47792368CADD1D410C663980B09C55AFDBC4265ED6719550A915715833CAD6EFE02
SSDEEP 3072:NsJf/qp9FzpbpBogl7WIJ2FO8FzYDdA0WJuTxI5I8q9QxraM:qJXqp9FF9qggFtOdzWJga5cY

Runtime Data

Usage (stdout):


Microsoft DiskPart version 10.0.14393.0

Copyright (C) 1999-2013 Microsoft Corporation.
On computer: default-pc

Microsoft DiskPart syntax:
	diskpart [/s <script>] [/?]

	/s <script> - Use a DiskPart script.
	/?          - Show this help screen.

Signature

  • Status: Signature verified.
  • Serial: 33000000BCE120FDD27CC8EE930000000000BC
  • Thumbprint: E85459B23C232DB3CB94C7A56D47678F58E8E51E
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: diskpart.exe.mui
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.14393.0 (rs1_release.160715-1616)
  • Product Version: 10.0.14393.0
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.

Possible Misuse

The following table contains possible examples of diskpart.exe being misused. While diskpart.exe is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source Source File Example License
sigma proc_creation_win_malware_wannacry.yml # - '\diskpart.exe' # cannot be used in a rule of level critical DRL 1.0
sigma proc_creation_win_multiple_suspicious_cli.yml - diskpart.exe DRL 1.0

Additional Info*

*The information below is copied from MicrosoftDocs, which is maintained by Microsoft. Available under CC BY 4.0 license.


diskpart

Applies to: Windows Server 2022, Windows 10, Windows 8.1, Windows 8, Windows 7, Windows Server 2019, Windows Server 2016, Windows Server 2012 R2, Windows Server 2012, and Windows Server 2008 R2, Windows Server 2008

The diskpart command interpreter helps you manage your computer’s drives (disks, partitions, volumes, or virtual hard disks).

Before you can use diskpart commands, you must first list, and then select an object to give it focus. After an object has focus, any diskpart commands that you type will act on that object.

List available objects

You can list the available objects and determine an object’s number or drive letter by using:

  • list disk - Displays all the disks on the computer.

  • list volume - Displays all the volumes on the computer.

  • list partition - Displays the partitions on the disk that has focus on the computer.

  • list vdisk - Displays all the virtual disks on the computer.

After you run the list commands, an asterisk (*) appears next to the object with focus.

Determine focus

When you select an object, the focus remains on that object until you select a different object. For example, if the focus is set on disk 0 and you select volume 8 on disk 2, the focus shifts from disk 0 to disk 2, volume 8.

Some commands automatically change the focus. For example, when you create a new partition, the focus automatically switches to the new partition.

You can only give focus to a partition on the selected disk. After a partition has focus, the related volume (if any) also has focus. After a volume has focus, the related disk and partition also have focus if the volume maps to a single specific partition. If this isn’t the case, focus on the disk and partition is lost.

Syntax

To start the diskpart command interpreter, at the command prompt type:

diskpart <parameter>

[!IMPORTANT] You must be in your local Administrators group, or a group with similar permissions, to run diskpart.

Parameters

You can run the following commands from the Diskpart command interpreter:

Command Description
active Marks the disk’s partition with focus, as active.
add Mirrors the simple volume with focus to the specified disk.
assign Assigns a drive letter or mount point to the volume with focus.
attach vdisk Attaches (sometimes called mounts or surfaces) a virtual hard disk (VHD) so that it appears on the host computer as a local hard disk drive.
attributes Displays, sets, or clears the attributes of a disk or volume.
automount Enables or disables the automount feature.
break Breaks the mirrored volume with focus into two simple volumes.
clean Removes any and all partition or volume formatting from the disk with focus.
compact vdisk Reduces the physical size of a dynamically expanding virtual hard disk (VHD) file.
convert Converts file allocation table (FAT) and FAT32 volumes to the NTFS file system, leaving existing files and directories intact.
create Creates a partition on a disk, a volume on one or more disks, or a virtual hard disk (VHD).
delete Deletes a partition or a volume.
detach vdisk Stops the selected virtual hard disk (VHD) from appearing as a local hard disk drive on the host computer.
detail Displays information about the selected disk, partition, volume, or virtual hard disk (VHD).
exit Exits the diskpart command interpreter.
expand vdisk Expands a virtual hard disk (VHD) to the size that you specify.
extend Extends the volume or partition with focus, along with its file system, into free (unallocated) space on a disk.
filesystems Displays information about the current file system of the volume with focus and lists the file systems that are supported for formatting the volume.
format Formats a disk to accept Windows files.
gpt Assigns the gpt attribute(s) to the partition with focus on basic GUID partition table (gpt) disks.
help Displays a list of the available commands or detailed help information on a specified command.
import Imports a foreign disk group into the disk group of the local computer.
inactive Marks the system partition or boot partition with focus as inactive on basic master boot record (MBR) disks.
list Displays a list of disks, of partitions in a disk, of volumes in a disk, or of virtual hard disks (VHDs).
merge vdisk Merges a differencing virtual hard disk (VHD) with its corresponding parent VHD.
offline Takes an online disk or volume to the offline state.
online Takes an offline disk or volume to the online state.
recover Refreshes the state of all disks in a disk group, attempt to recover disks in an invalid disk group, and resynchronizes mirrored volumes and RAID-5 volumes that have stale data.
rem Provides a way to add comments to a script.
remove Removes a drive letter or mount point from a volume.
repair Repairs the RAID-5 volume with focus by replacing the failed disk region with the specified dynamic disk.
rescan Locates new disks that may have been added to the computer.
retain Prepares an existing dynamic simple volume to be used as a boot or system volume.
san Displays or sets the storage area network (san) policy for the operating system.
select Shifts the focus to a disk, partition, volume, or virtual hard disk (VHD).
set id Changes the partition type field for the partition with focus.
shrink Reduces the size of the selected volume by the amount you specify.
uniqueid Displays or sets the GUID partition table (GPT) identifier or master boot record (MBR) signature for the disk with focus.

Additional References


MIT License. Copyright (c) 2020-2021 Strontic.