# SCSI Info

## Overview

**Evidence:** SCSI Info\
**Description:** ESXi SCSI Info\
**Category:** DiskFilesystem\
**Platform:** esxi\
**Short Name:** scsiinfo\
**Is Parsed:** Yes\
**Sent to Investigation Hub:** Yes\
**Collect File(s):** No

## Background

SCSI storage devices and adapters connect ESXi hosts to local and remote storage systems. SCSI device inventory reveals storage topology, LUN mappings, and adapter configurations that are essential for understanding data storage architecture and detecting unauthorized storage access.

## Data Collected

This collector gathers structured data about scsi info.

### SCSI Info Data

| Field             | Description      | Example       |
| ----------------- | ---------------- | ------------- |
| `DeviceType`      | Device Type      | Example value |
| `Size`            | Size             | Example value |
| `DisplayName`     | Display Name     | Example value |
| `MultipathPlugin` | Multipath Plugin | Example value |
| `ConsoleDevice`   | Console Device   | Example value |
| `DevfsPath`       | Devfs Path       | Example value |
| `Vendor`          | Vendor           | Example value |
| `Model`           | Model            | Example value |
| `Revision`        | Revision         | Example value |
| `SCSILevel`       | SCSI Level       | Example value |
| `IsPseudo`        | Is Pseudo        | Example value |
| `Status`          | Status           | Example value |
| `IsRDMCapable`    | Is RDM Capable   | Example value |
| `IsRemovable`     | Is Removable     | Example value |
| `IsLocal`         | Is Local         | Example value |
| `IsSSD`           | Is SSD           | Example value |
| `OtherNames`      | Other Names      | Example value |
| `VAAIStatus`      | VAAI Status      | Example value |

## Collection Method

This collector parses SCSI device information, extracting device names, adapter types, target IDs, LUN numbers, vendor identifiers, product information, device sizes, and operational states for each SCSI device visible to the ESXi host.

## Forensic Value

SCSI configuration analysis helps identify unauthorized LUN presentations, detect rogue storage devices, validate storage security configurations, and trace data access paths. Unexpected SCSI devices or LUN changes may indicate storage-based data exfiltration attempts or unauthorized backup access.