How to run Kape on all the drives ?

[MSQ7]

Hi,
I'm training to run Kape on all the drivers with one time execution, for example running Kon drive C,D and E.

[EricZimmerman]

And what is the question?

If you wanna run it against all drives (I don't know why) you'd have to write a powershell script or similar.

[AndrewRathbun]

One option is to make an _kape.cli with the following contents:

.\kape.exe --tsource A: --tdest C:\temp --target KapeTriage --vss --zip %m_%d --debug
.\kape.exe --tsource B: --tdest C:\temp --target KapeTriage --vss --zip %m_%d --debug
.\kape.exe --tsource C: --tdest C:\temp --target KapeTriage --vss --zip %m_%d --debug
.\kape.exe --tsource D: --tdest C:\temp --target KapeTriage --vss --zip %m_%d --debug
.\kape.exe --tsource E: --tdest C:\temp --target KapeTriage --vss --zip %m_%d --debug
.\kape.exe --tsource F: --tdest C:\temp --target KapeTriage --vss --zip %m_%d --debug
.\kape.exe --tsource G: --tdest C:\temp --target KapeTriage --vss --zip %m_%d --debug
.\kape.exe --tsource H: --tdest C:\temp --target KapeTriage --vss --zip %m_%d --debug
.\kape.exe --tsource I: --tdest C:\temp --target KapeTriage --vss --zip %m_%d --debug
.\kape.exe --tsource J: --tdest C:\temp --target KapeTriage --vss --zip %m_%d --debug
.\kape.exe --tsource K: --tdest C:\temp --target KapeTriage --vss --zip %m_%d --debug
.\kape.exe --tsource L: --tdest C:\temp --target KapeTriage --vss --zip %m_%d --debug
.\kape.exe --tsource M: --tdest C:\temp --target KapeTriage --vss --zip %m_%d --debug
.\kape.exe --tsource N: --tdest C:\temp --target KapeTriage --vss --zip %m_%d --debug
.\kape.exe --tsource O: --tdest C:\temp --target KapeTriage --vss --zip %m_%d --debug
.\kape.exe --tsource P: --tdest C:\temp --target KapeTriage --vss --zip %m_%d --debug
.\kape.exe --tsource Q: --tdest C:\temp --target KapeTriage --vss --zip %m_%d --debug
.\kape.exe --tsource R: --tdest C:\temp --target KapeTriage --vss --zip %m_%d --debug
.\kape.exe --tsource S: --tdest C:\temp --target KapeTriage --vss --zip %m_%d --debug
.\kape.exe --tsource T: --tdest C:\temp --target KapeTriage --vss --zip %m_%d --debug
.\kape.exe --tsource U: --tdest C:\temp --target KapeTriage --vss --zip %m_%d --debug
.\kape.exe --tsource V: --tdest C:\temp --target KapeTriage --vss --zip %m_%d --debug
.\kape.exe --tsource W: --tdest C:\temp --target KapeTriage --vss --zip %m_%d --debug
.\kape.exe --tsource X: --tdest C:\temp --target KapeTriage --vss --zip %m_%d --debug
.\kape.exe --tsource Y: --tdest C:\temp --target KapeTriage --vss --zip %m_%d --debug
.\kape.exe --tsource Z: --tdest C:\temp --target KapeTriage --vss --zip %m_%d --debug

Another is PowerShell 7, as Eric mentioned. Gemini came up with this, and you can tweak it as you see fit:

# Define the base KAPE command with placeholders
$kapeCommandBase = '.\kape.exe --tsource {0} --tdest C:\temp --target KapeTriage --vss --zip %m_%d --debug'

# Get all valid drive letters on the system
$driveLetters = (Get-PSDrive -PSProvider FileSystem).Name

# Loop through each drive letter and execute the KAPE command
foreach ($drive in $driveLetters) {
    # Format the KAPE command with the current drive letter
    $kapeCommand = $kapeCommandBase -f $drive

    # Display the command being executed for clarity (optional)
    Write-Host "Executing command: $kapeCommand"

    # Execute the KAPE command
    Invoke-Expression $kapeCommand
}

String interpolation, ftw. Yes, I tested it and it works, but tweak as needed, and strongly consider why you'd need to grab triage from every possible drive letter on a host.