Need help with diskutil list

[tkimpton]

Hi guys

I've been trying to get the IDENTIFIER of a usb stick plugged in so i can use disk1s1 as a variable

Im having problems cutting out the spaces and i was wondering if anyone knows how to just get disk1s1?

This is what i have so far

diskutil list | grep RALLY | grep disk 1: Windows_FAT_32 RALLY2 64GB 64.2 GB disk1s1

[kitzy · Accepted solution]

You should just be able to do this:

diskutil list | grep RALLY | awk '{print $7}'

Tested fine on my machine using Macintosh HD instead of RALLY.

[kitzy · Accepted solution]

You should just be able to do this:

diskutil list | grep RALLY | awk '{print $7}'

Tested fine on my machine using Macintosh HD instead of RALLY.

[tkimpton]

thanks very much this worked :)

[kitzy]

No problem! Glad I could help.

[mm2270]

Another way which may be a little more reliable would be to get the last column of output with $NF and also use awk's regex matching in one shot.

diskutil list | awk '/RALLY/{print $NF}'

You can replace RALLY with any other disk name, including ones with spaces. No need to escape the spaces:

diskutil list | awk '/Recovery HD/{print $NF}'

[tkimpton]

Thanks Mike. I uploaded a script to JAMFNATION so i will contact my account manager to relace it with an updated version :)

[tkimpton]

Unfortunately i've hit another stumbling block

I need to be able to pass the Mount Point as another variable.

this is what i put in

diskutil info disk1s1 | awk -F"/" '/Mount Point/{ print $NF }'

and i get the output

RALLY2 64GB

As you can see my pen drive has a space in it. If i try to use this as a variable it fails because it is looking for /Volumes/RALLY2 64GB/

Can anyone help?

[mm2270]

Just quote the variable when you need to use it -

driveName=`diskutil info disk1s1 | awk -F"/" '/Mount Point/{ print $NF }'`

echo "$driveName"

[tkimpton]

Thanks Mike

Unfortunately when i do that i get

RALLY2 64GB

what i am trying to do is get RALLY2 64GB

if i do

driveName=`diskutil info disk1s1 | awk -F"/" '/Mount Point/{ print $NF }'`

echo "$driveName" | sed 's/ /\ /g'

that gives me RALLY2 64GB

but i am having problems passing that on as a variable because i am wanting to do this command

# Sophos Anti-Virus scan the disk
savscan=`/usr/bin/sweep /Volumes/"$diskName" | grep ">>> Virus" | cut -d"'" -f3 | cut -c 16- | sed 's/ /\ /g'`

# trigger the virus file to show the gui virus alert to the user
touch "$savscan"

this unfortunately returns

/Volumes/RALLY2 64GB/eicar.com.txt: No such file or directory

[mm2270]

Not sure if it'll help, but you can try moving the open quote mark to the left of /Volumes like this:

savscan=`/usr/bin/sweep "/Volumes/$diskName" | grep ">>> Virus" | cut -d"'" -f3 | cut -c 16- | sed 's/ / /g'`

That quotes the entire string from the /Volumes line, which may prevent the error you're getting.

[tkimpton]

unfortunately this brings back

touch: /Volumes/RALLY2 64GB/eicar.com.txt
/Volumes/RALLY2 64GB/eicar.com.txt: No such file or directory

[tkimpton]

If i touch the file manually it works fine

[mm2270]

OK, as I don't have anything I can really test your script against, I'm just taking some educated guesses here. but try echoing the results of grabbing the disk name back into a second variable and use that instead.

#!/bin/sh
driveName=`diskutil info disk1s1 | awk -F"/" '/Mount Point/{ print $NF }'`
DiskName=`echo $driveName`

# Sophos Anti-Virus scan the disk
savscan=`/usr/bin/sweep "/Volumes/$DiskName" | grep ">>> Virus" | cut -d"'" -f3 | cut -c 16- | sed 's/ / /g'`

# trigger the virus file to show the gui virus alert to the user
touch "$savscan"

If that doesn't work, not sure what else to tell you. Perhaps someone that uses Sophos can help out with testing. Its hard for me to know how the /usr/bin/sweep binary is attempting to write the file to disk since we don't use it here.

Edit: Quick variation on the above, using one of the lines from your post a few up this thread. Create a new variable with the echo line that swaps out spaces for escaped spaces, like this-

#!/bin/sh
driveName=`diskutil info disk1s1 | awk -F"/" '/Mount Point/{ print $NF }'`
DiskName=`echo "$driveName" | sed 's/ / /g'

# Sophos Anti-Virus scan the disk
savscan=`/usr/bin/sweep /Volumes/$DiskName | grep ">>> Virus" | cut -d"'" -f3 | cut -c 16- | sed 's/ / /g'`

# trigger the virus file to show the gui virus alert to the user
touch "$savscan"

That should, in effect, be passing /Volumes/RALLY2 64GB to the command, which hopefully won't trip it up. Didn't test that at all, so I could be talking out of my rear. Hopefully it works though!

[jarednichols]

Oy. Amateurs. Throw it through awk

diskutil list | grep "Macintosh HD" | awk '{print $3 " " $4}' | awk '{printf(""%s"
", $0);}'

Replace "Macintosh HD" with your "RALLY2" (or whatevs). Encapsulating your path with quotes works the same as escaping the spaces.

[tkimpton]

no joy im afraid Mike

#!/bin/sh


# Get the disk name of the removable Media
for disk in $(diskutil list | awk '/disk[1-9]s/{ print $NF }' | grep -v /dev); do
if [[ $(diskutil info $disk | awk '/Protocol/{ print $2 }' | egrep "USB|FireWire|SATA") != "" ]]; then
echo "Device $disk is a removable disk"
driveName=`diskutil info $disk | awk -F"/" '/Mount Point/{ print $NF }'`
DiskName=`echo $driveName`
fi
done

# Sophos Anti-Virus scan the disk
savscan=`/usr/bin/sweep "/Volumes/$DiskName" | grep ">>> Virus" | cut -d"'" -f3 | cut -c 16- | sed 's/ /\ /g'`

# trigger the virus file to show the gui virus alert to the user
touch "$savscan"

i will look at that Jared, i just need to quit the computer for a while before my wife hits me again.

[jarednichols]

i will look at that Jared, i just need to quit the computer for a while before my wife hits me again.

haha tell her to start helping then :)

[tkimpton]

Unfortunately doesnt work in my script Jared

[mm2270]

Can you clarify exactly what it is you're looking to do here? I'm just not sure what the ultimate goal is. Perhaps there's a better way to handle this?
'Cause I don't see why quoting the disk name variable doesn't work. Quoting items with spaces is standard practice, so something wonky is going on if its not working for you.

For example, the following works fine for me-

#!/bin/sh

for disk in $(diskutil list | awk '/disk[1-9]s/{ print $NF }' | grep -v /dev); do
    if [[ $(diskutil info $disk | awk '/Protocol/{ print $2 }' | egrep "USB|FireWire|SATA") != "" ]]; then
        diskName=$(diskutil info $disk | awk -F: '/Mount Point/{print $NF}' | sed 's/^[ 	]*//' )
        echo "Hello World" > "$diskName/myfile.txt"
    fi
done

It creates a new file at the root of an attached USB drive called "myfile.txt" with the contents of "Hello World"
I tested it with a USB drive named "32 GB thumb drive", so lots of spaces and it had no issue writing the txt file to the drive. Your /usr/bin/sweep command must be doing something different than the norm if it gets tripped up on touching the file to the disk.

[tkimpton]

The ultimate is to automatically scan external media as soon as it gets plugged in, to then go and touch the virus if it exists to cause the Quarantine Manager to display the warning to the user.

I did the same thing by writing it to a text file and it seemed ok.

I then tried to used the text file in a variable but still didnt work. I think your right with that sweep command doing something different.

Thanks for your help i will keep playing around with it.

[tkimpton]

strange thing is though

#!/bin/bash

# Get the disk name of the removable Media
for disk in $(diskutil list | awk '/disk[1-9]s/{ print $NF }' | grep -v /dev); do
if [[ $(diskutil info $disk | awk '/Protocol/{ print $2 }' | egrep "USB|FireWire|SATA") != "" ]]; then
diskName=$(diskutil info $disk | awk -F: '/Mount Point/{print $NF}' | sed 's/^[ 	]*//' )

/usr/bin/sweep "$diskName" | grep ">>> Virus" | cut -d"'" -f3 | cut -c 16- | sed 's/ /\ /g'


fi
done

comes back with what i want

/Volumes/RALLY2 64GB/eicar.com.txt

but what ever i do i cant get it in a variable to touch it.

[mm2270]

Why can't you jus use a redirect instead of trying to touch the file as a separate step? You're already pulling the info you want with the grep ">>> Virus" part. Just try to redirect the output into the file on the same line with > "$diskName/somefilename"

[rockpapergoat]

bikeshed threads like this are fun. *

take a look at using a launchdaemon with a watchpath to do things on volume mount.

or crankd might fit the bill. it uses system events to trigger behaviors. here's a detailed intro:

http://glarizza.com/using-crankd-to-react-to-network-events

or keep writing fragile shell scripts with positional parameters that will break easily.

do be sure to drop some change in your technical debt relief fund when you're done, though.

* i'm really crying here.

[tkimpton]

@mm2270

i am trying to touch the file to activate the Sophos Quanarantine manager which will then show the user the message and eject the removable media

https://jamfnation.jamfsoftware.com/viewProductFile.html?id=115&fid=634

the sweep command just flags to the shell with >>> Virus where as the gui app says "Threat" in the Sophos Log.

The point is that the sweep command is pants and thanks for your help guys but please refrain from making comments like Oi Amateurs etc Jared

[tkimpton]

@rockpapergoat

plan to ... but need a working script before i do the next phase which is launch daemon

[tkimpton · Accepted solution]

not sure why it didnt work yesterday but it does today

i noticed on my usb drive i had another file called the same thing

In terminal is showed as com.eicar.txt^M. After deleting it all is ok

#!/bin/bash

##########################################   HISTORY ##################################################
#                                                                                                     #
#  Created by Tim Kimpton                                                                             #
#                                                                                                     #
#  27/2/2013                                                                                          #
#                                                                                                     #
#  Version 1.5                                                                                        #
#                                                                                                     #
# This is used with a launch daemon to run the script every time a volume is mounted                  #
#                                                                                                     #
# This script will search if there is removable media and will automatically scan the media           #
#                                                                                                     #
# If there is a virus the system tries to "touch the file" which activate the SAV Quarantine Manager  #
#                                                                                                     #
#######################################################################################################

# Get the disk name of the removable Media
for disk in $(diskutil list | awk '/disk[1-9]s/{ print $NF }' | grep -v /dev); do
if [[ $(diskutil info $disk | awk '/Protocol/{ print $2 }' | egrep "USB|FireWire|SATA") != "" ]]; then
diskName=$(diskutil info $disk | awk -F: '/Mount Point/{print $NF}' | sed 's/^[ 	]*//' )


# Use the Sophos Anti-Virus sweep command to scan the removable media
sav=`/usr/bin/sweep "$diskName" | grep ">>> Virus" | cut -d"'" -f3 | cut -c 16- | sed 's/ /\ /g'`

# Touch the file to Triggeer the Sophos Quarantine Manager
touch "$sav"

fi
done

[xwolf2k]

Hello,

I'm having an issue using the "diskutil secureErase freespace 3/ Volume/name-of-drive" command.

The name of my hard drive is Macintosh HD but the command keeps saying can't find "HD". If I don't put a space, it'll come back with can't find "MacintoshHD"

Any ideas on how to get this to work?

Thanks!

[acdesigntech]

encase it is double quotes:

for example:

diskutil list | grep "Macintosh HD"

[xwolf2k]

@acdesigntech - I'm sorry I don't understand what that means.

[acdesigntech]

sorry, typo. I meant encase it IN double quotes. so take your command and put double quotes around the drive name. That way it will preserve the space between macintosh and hd.

Something like:

diskutil secureErase freespace 3/ Volumes/"name-of-drive"

[xwolf2k]

I get this for a response

Kens-Macbook-Pro:~ Ken1$ diskutil secureErase freespace 3/ Volume/"Macintosh HD"
Could not find the disk Volume/Macintosh HD

I can't think why it can't seem to find my hard drive. The icon on my desktop sayings Macintosh HD in white under the icon. I have to believe that's the name, correct?

[bentoms]

Try Volumes & not Volume.

[xwolf2k]

Kens-Macbook-Pro:~ Ken1$ diskutil secureErase freespace 3/ Volumes/"Macintosh HD"
Could not find the disk Volumes/Macintosh HD

lol going insane here

[bentoms]

Sorry. Try: /Volumes/ then.

[xwolf2k]

winnah winnah chicken dinnah!! Thank you!! :)

[bentoms]

No worries.

I've wasted hours over silly syntax issues too.