track_usb.ps1

• 该文件用于打包成主程序 - USBLogSrv.exe

# 获取通过USB总线连接的所有移动盘
# Get-Disk | Where-Object {$_.Bustype -eq "USB"}
# 获取磁盘号
# $disk_num = (Get-Disk | Where-Object {$_.Bustype -eq "USB"}).number 
# 查看值的数据类型
# echo $disk_num.GetType()
# 获取移动盘盘符
function GetDrive {
    # 获取磁盘号
    $num = (Get-Disk | Where-Object {$_.Bustype -eq "USB"}).number
    # 磁盘信息
    # ($num | ForEach-Object{(Get-Disk -Number $_)  |Format-list number,FriendlyName,SerialNumber,@{name='Size(GB)';expression={$_.Size / 1GB -as [int]}}} | Out-String).Trim()
    if($num.count -ne 0){
        # 获取对应的盘符
        $drive = $num | ForEach-Object{((Get-Partition -DiskNumber $_) | ?{!$_.IsHidden}).DriveLetter}        
        return $drive
    }
}
# 获取移动盘分区剩余大小
function DriveSize {       
    $drv = GetDrive
    if($drv.count -ne 0){
        $disk_remain_size = (Get-Volume -DriveLetter $drv).SizeRemaining
        return $disk_remain_size
    }    
}
# 获取本机物理网卡IP
function ip{
    $macadd = (Get-NetAdapter -Physical | ? Status -EQ "Up").MacAddress
    $address = foreach($address in (ipconfig /all) -like '*地址*') { ($address -split ' : ')[-1]} 
    # $macadd使用ForEach-Object，是考虑到PC有多个物理网卡
    $macadd | ForEach-Object{
        # 将$_赋值给$macadd， 是为了和$address的$_做区分
        $macadd = $_
        $address | ForEach-Object{
            if($_ -like '*首选*'){
                $index = [array]::IndexOf($address, $_)
                $host_mac = $address[$($index-1)]
                if($host_mac -eq $macadd){
                    $ip = ($_ -split '\(')[0]
                    return $ip 
                }
            }         
        }
    }   
}
# 钉钉报警
function ddalert($ipfun, $info){    
    $time = (Get-Date).ToShortTimeString()
    # 接收定义的ip函数作为参数传入
    $ip = Invoke-Command $ipfun    
    #在15:41过去5分钟内，主机DN2D-00088，IP地址10.2.234.13，拷贝 50.91 MB大小数据到 F 移动盘 
    $content = $time + " 主机" + $env:COMPUTERNAME + "，IP地址" + $ip + "，" + $info
    $par = @{
        msgtype = "text";
        text = @{
            content = $content;        
        };
    }
    $parjson = $par | ConvertTo-Json
    # 内网告警群
    #$ddhook = "https://oapi.dingtalk.com/robot/send?access_token=xxxxxx"
    # 深圳告警群
    $ddhook = "https://oapi.dingtalk.com/robot/send?access_token=xxxxx"
    # 使Json支持中文
    $PostData = [System.Text.Encoding]::UTF8.GetBytes($parjson)
    $Header = @{"Content-Type" = "application/json;charset=utf-8"}
    # 参数UseBasicParsing对URI只进行简单解析，可提高效率
    Invoke-WebRequest -Uri $ddhook -Method Post -Body $PostData -Headers $Header -UseBasicParsing | Out-Null
     # 输出日志到本地
     msg $content   
} 
# 输出日志信息到本地
function msg($message){      
    $date = (Get-Date).GetDateTimeFormats()[1]    
    $folder = Test-Path $env:PUBLIC\USBLogs
    if($folder -eq $false){
        New-Item -Path "$env:PUBLIC\" -Name "USBLogs" -ItemType "directory" | Out-Null
    }
    $message >> $env:PUBLIC\USBLogs\$date.log
}
while(1){   
    if(GetDrive){    
        $before = DriveSize        
        # 间隔1分钟检测一次 
        sleep 60      
        $after = DriveSize
        # 判断是否拷贝数据
        $len = $after.Count
        for($i=0;$i -lt $len;$i++){
            $b = $before[$i]
            $a = $after[$i]             
            if($a -lt $b){
                # {0:N2}保留两位小数点
                $filesize = "{0:N2}" -f $(($b - $a) / 1MB)
                # 获取拷贝数据的移动盘具体分区盘符
                $drive = (Get-Volume (GetDrive) | ?{$_.SizeRemaining -eq $a}).DriveLetter                
                $info = "拷贝 $filesize MB大小数据到 $drive 移动盘"
                #$message = $time + " 主机" + $env:COMPUTERNAME + "，IP地址" + (ip) + "，" + $info
                # 输出日志到钉钉机器人（ 将${function:ip}函数ip作为参数,传递给函数ddalert ）
                ddalert ${function:ip} $info
                #ddalert $message $info              
                $before = $after
            }elseif($a -gt $b){
                $before = $after
            }
        }        
    }
    $time = (Get-Date).ToShortTimeString()
    if($time -eq "12:30"){
        $path = "$env:PUBLIC\USBLogSrv"    
        # update.ps1存放路径                
        powershell -noprofile -command "&{ start-process powershell -ArgumentList '-noprofile -file $path\update.ps1' -verb RunAs -WindowStyle Hidden}"
        # 若未sleep，且在当前时间内没有插入移动盘，会持续执行update，以产生多个powershell进程
        sleep 60
    }
}