Export-CxSmbShareEvidence

Namespace ComputerX.PowerShell

Inputs

System.String System.String[]

Outputs

ComputerX.Smb.SmbShareEvidenceExportResult

Exports normalized SMB share evidence files for offline review, migration planning, or redacted support handoff.

Examples

Authored help example

Example 1: Exports a recursive evidence package for one share.

PS>


Export-CxSmbShareEvidence -ComputerName FS01 -ShareName Finance -OutputPath C:\Evidence\Finance -MaxDepth 3

Example 2: Exports a redacted support bundle.

PS>


Export-CxSmbShareEvidence -ComputerName FS01 -ShareName Finance -OutputPath C:\Evidence\Support -RedactedSupportBundle

Common Parameters

This command supports the common parameters: -Debug, -ErrorAction, -ErrorVariable, -InformationAction, -InformationVariable, -OutVariable, -OutBuffer, -PipelineVariable, -Verbose, -WarningAction, and -WarningVariable.

For more information, see about_CommonParameters.

Syntax

Export-CxSmbShareEvidence [-ComputerName <string>] [-ShareName <string[]>] -OutputPath <string> [-IncludeOpenFileSamples] [-IncludeSpecialShares] [-MaxDepth <int>] [-OpenFileSampleCount <int>] [-OpenFileSampleIntervalSeconds <int>] [-RedactedSupportBundle] [-SkipDirectories] [-SkipFiles] [<CommonParameters>]

Parameters

ComputerName string optionalposition: 0pipeline: true (ByPropertyName): Target computer name. Use . for the local machine or provide a DNS/NetBIOS name.
ShareName string[] optionalposition: 1pipeline: true (ByPropertyName): Optional share-name filter. When omitted, all non-special shares are scanned.
OutputPath string requiredposition: 2pipeline: false: Output directory for the normalized evidence files.
IncludeOpenFileSamples SwitchParameter optionalposition: namedpipeline: false: Includes timestamped open-file samples.
IncludeSpecialShares SwitchParameter optionalposition: namedpipeline: false: Includes hidden administrative and special shares when no share-name filter is supplied.
MaxDepth int optionalposition: namedpipeline: false: Maximum recursion depth. Zero scans only the share root.
OpenFileSampleCount int optionalposition: namedpipeline: false: Number of open-file samples to collect.
OpenFileSampleIntervalSeconds int optionalposition: namedpipeline: false: Seconds between open-file samples.
RedactedSupportBundle SwitchParameter optionalposition: namedpipeline: false: Exports a redacted support bundle instead of raw evidence.
SkipDirectories SwitchParameter optionalposition: namedpipeline: false: Skips directory rows during recursive scanning.
SkipFiles SwitchParameter optionalposition: namedpipeline: false: Skips file rows during recursive scanning.

Outputs

ComputerX.Smb.SmbShareEvidenceExportResult