SCSI Info

Overview

Evidence: SCSI Info Description: ESXi SCSI Info Category: DiskFilesystem Platform: esxi Short Name: scsiinfo Is Parsed: Yes Sent to Investigation Hub: Yes Collect File(s): No

Background

SCSI storage devices and adapters connect ESXi hosts to local and remote storage systems. SCSI device inventory reveals storage topology, LUN mappings, and adapter configurations that are essential for understanding data storage architecture and detecting unauthorized storage access.

Data Collected

This collector gathers structured data about scsi info.

SCSI Info Data

Field	Description	Example
DeviceType	Device Type	Example value
Size	Size	Example value
DisplayName	Display Name	Example value
MultipathPlugin	Multipath Plugin	Example value
ConsoleDevice	Console Device	Example value
DevfsPath	Devfs Path	Example value
Vendor	Vendor	Example value
Model	Model	Example value
Revision	Revision	Example value
SCSILevel	SCSI Level	Example value
IsPseudo	Is Pseudo	Example value
Status	Status	Example value
IsRDMCapable	Is RDM Capable	Example value
IsRemovable	Is Removable	Example value
IsLocal	Is Local	Example value
IsSSD	Is SSD	Example value
OtherNames	Other Names	Example value
VAAIStatus	VAAI Status	Example value

Collection Method

This collector parses SCSI device information, extracting device names, adapter types, target IDs, LUN numbers, vendor identifiers, product information, device sizes, and operational states for each SCSI device visible to the ESXi host.

Forensic Value

SCSI configuration analysis helps identify unauthorized LUN presentations, detect rogue storage devices, validate storage security configurations, and trace data access paths. Unexpected SCSI devices or LUN changes may indicate storage-based data exfiltration attempts or unauthorized backup access.