Step 5. Collecting System Information — A Health Checkup for My Computer

Level 0 — Understanding How to Operate a Computer and How It Is Structured | Difficulty ★★☆☆☆ | Estimated time: 2–3 hours

Prerequisite: Step 4. Use Windows PowerShell 5.1 or PowerShell 7 on Windows.

• You need: a Windows PC you own or are authorized to use for this exercise, and PowerShell.
• What changes: a new practice folder and text reports. You will query system information without stopping processes or changing services.
• Deliverables: a basic report and a complete mission report. Success means reading and explaining OS, memory, process, service, and storage information.

When investigating a fault or security incident, first establish what system you are looking at, what is running, and how much storage remains. This lesson practices that information gathering. The title’s “health checkup” is a metaphor: the report is an observation at a particular time, not proof that the computer is healthy or free of malware.

Full query output can contain device names, account names, and paths. Keep your report on your PC and show only the fields needed when sharing a screenshot. This exercise does not upload a report to an external server.

1. Learning Objectives

• Select the OS and hardware properties you need from Get-ComputerInfo.
• Explain processes versus services and count returned running services.
• Read free space for file-system drives.
• Create, append to, and reread a report with consistent UTF-8 encoding.

2. Background Knowledge — Today’s Tools and Concepts

This section’s Tools at a Glance

2-1. Four Computer Resources

CPU performs computation, memory holds active work, disks provide storage, and networks carry communications. Today we observe OS, memory, processes, services, and drive space. Network information belongs to Step 6. These commands do not measure the performance of all four resources.

2-2. Processes and Services

A process is an executing program instance. A user, the operating system, or another program can start one. A service is a function managed by the Windows Service Control Manager. Services can start automatically, manually, or in response to triggers, and installed services can be stopped. Several services can share a process, so service counts and process counts are different.

Attackers can abuse service registration for persistence, making services relevant to an investigation. An unfamiliar name or a high count is not enough to identify malware. Today you will inspect, without deleting services, stopping them, or changing startup types.

2-3. Baselines — Records You Can Compare

A baseline is a reference for comparison. Record collection time, workload, and query errors to make later comparisons meaningful. Your first snapshot is not automatically a known-good state. A running-service count can change when existing services start or stop; an increase does not prove a new service was registered.

3. Follow Along

Before you begin. Record collection time and failures with the report. A first snapshot is a baseline for comparison, not proof of a known-good system.

3-1. System Information and Selected Properties

Get-ComputerInfo

Collection can take some time. Output uses property names and values and varies by machine. This example illustrates how to read it; your values need not match:

OsName                : Microsoft Windows 11 Pro
OsVersion             : 10.0.26200
CsTotalPhysicalMemory : 16576139264

• OsName: operating-system name and edition.
• OsVersion: version string. Windows 11 versions can still begin with 10.0.
• CsTotalPhysicalMemory: system-reported total physical memory in bytes. The example is about 16.58 GB or 15.44 GiB. Hardware reservations and other factors can make this differ from the advertised installed capacity.

Request the three properties we will use:

Get-ComputerInfo -Property OsName, OsVersion, CsTotalPhysicalMemory

The Step 3 form Get-ComputerInfo | Select-Object OsName, OsVersion, CsTotalPhysicalMemory also chooses properties for output. A downstream Select-Object does not undo collection work or fix errors in the command that ran before it.

3-2. Current Processes — Largest Working Sets

Get-Process | Sort-Object WorkingSet64 -Descending | Select-Object -First 5 ProcessName, Id, WorkingSet64

WorkingSet64 is the process working-set size in bytes. This returns up to five processes ordered largest first. An application may use multiple processes, so these are not the five applications with the largest combined memory usage. Id is the process ID.

892,345,600 bytes is about 892.35 MB or 851.01 MiB. A Task Manager column may use a different memory definition. A browser appearing near the top does not prove normal behavior, and an unfamiliar name does not prove malware. Reliable identification needs more evidence, such as the executable path, signature, and execution context.

3-3. The Service List — Get-Service

Get-Service

Status is the state, Name the internal name, and DisplayName the friendly name. Running and Stopped are common states; Paused and transitional states also exist. Select running services:

Get-Service | Where-Object {$_.Status -eq "Running"}

Predict first: what would adding | Measure-Object count? It counts running services returned by that query. There is no universal “100–200 is normal” range. Query errors can mean the results are incomplete.

3-4. Available Drive Space — Get-PSDrive

Get-PSDrive -PSProvider FileSystem

-PSProvider FileSystem selects file-system drives. Without it, Get-PSDrive also shows providers such as Alias, Env, and Registry. File-system results may include network drives or temporary drives pointing to the same storage, so do not simply add their capacities together.

Name   Used (GB)   Free (GB)   Provider     Root
----   ---------   ---------   --------     ----
C         547.69      376.91   FileSystem   C:\

This table illustrates the format. Values labeled GB in the default table are scaled by 1,073,741,824 bytes. The report below writes the Used and Free properties directly in bytes to make the unit explicit. An empty value does not mean zero bytes.

Low free space can disrupt saving, logging, and updates. “Warn below 20%” is a possible operating policy, not a universal threshold. Also consider absolute free space, growth rate, and the capacity needed for updates. This command does not test drive hardware or SMART health.

3-5. Assemble a Basic Report

Create a new practice folder and begin the report. $systemlab holds the folder path; $basicReport holds the file path. Variables are covered in Step 7; for now, run the blocks in order. Report labels are in English so both language editions produce the same structure.

$systemlab = Join-Path $HOME ('infosec-step05-' + [guid]::NewGuid().ToString('N'))
New-Item -ItemType Directory -Path $systemlab -ErrorAction Stop
Set-Location -LiteralPath $systemlab
$basicReport = Join-Path $systemlab 'report-basic.txt'
Get-Date -Format o | Out-File -LiteralPath $basicReport -Encoding UTF8
"=== OS and physical memory (bytes) ===" | Out-File -LiteralPath $basicReport -Append -Encoding UTF8
Get-ComputerInfo -Property OsName, OsVersion, CsTotalPhysicalMemory |
  Format-List OsName, OsVersion, CsTotalPhysicalMemory |
  Out-File -LiteralPath $basicReport -Append -Encoding UTF8 -Width 4096
pwd

• Get-Date -Format o records the timestamp with an offset for interpreting time-zone differences.
• The first Out-File starts the report; later uses append. Rerunning this setup block creates another new practice folder.
• Use -Encoding UTF8 throughout to avoid differing defaults in 5.1 and 7.
• Format-List presents properties vertically instead of squeezing them into narrow table columns. -Width 4096 sets the output line width. This is still a text presentation, not lossless storage of arbitrary objects.

Continue in the same session:

"=== Top 5 processes by working set (bytes) ===" | Out-File -LiteralPath $basicReport -Append -Encoding UTF8
Get-Process | Sort-Object WorkingSet64 -Descending |
  Select-Object -First 5 ProcessName, Id, WorkingSet64 |
  Format-List | Out-File -LiteralPath $basicReport -Append -Encoding UTF8 -Width 4096

$serviceErrors = @()
$serviceSnapshot = @(Get-Service -ErrorAction Continue -ErrorVariable serviceErrors)
"=== Service query ===" | Out-File -LiteralPath $basicReport -Append -Encoding UTF8
"Query errors: $($serviceErrors.Count)" | Out-File -LiteralPath $basicReport -Append -Encoding UTF8
"Running: $(($serviceSnapshot | Where-Object {$_.Status -eq 'Running'} | Measure-Object).Count)" |
  Out-File -LiteralPath $basicReport -Append -Encoding UTF8

"=== FileSystem drives (Used / Free in bytes) ===" | Out-File -LiteralPath $basicReport -Append -Encoding UTF8
Get-PSDrive -PSProvider FileSystem | Format-List Name, Root, Used, Free |
  Out-File -LiteralPath $basicReport -Append -Encoding UTF8 -Width 4096

$serviceSnapshot stores one service query, and the report counts Running entries from that returned list. $serviceErrors collects service-query errors. If Query errors is not zero, counts may be incomplete. Do not change services or automatically elevate privileges just to make an error disappear. Errors or empty values in other queries also leave the affected fields unverified.

Read the file back and check the order: time → OS → top working sets → service query → drives.

Get-Content -LiteralPath $basicReport -Encoding UTF8

Do not assume a good-looking console table guarantees a complete saved report. Rereading the actual file to check its headings, property names, and values is part of the task. Report length varies by PC.

4. Missions and Exercises

Mission — My PC System Snapshot

1. Keep the basic report and create report-complete.txt in the same practice folder.
2. Start with a title and an alias, followed by the time and all existing sections.
3. Add up to three processes ranked by cumulative CPU time in seconds. Distinguish this from current CPU utilization (%).
4. Record Running and Stopped counts and query-error count from one returned service list.
5. Reread the report and explain what you observed and what remains unknown. You do not need to publish the original system details.

Exercises

1. How is selecting columns with Select-Object different from fixing an error in the source query?

2. Why can service and process counts differ? Does an unfamiliar service prove malware?

3. What happens when you omit Append in the middle of a report?

4. Does checking Free establish that a disk has no hardware fault? Is a 20% warning universal?

5. Does CPU = 120 mean current utilization of 120%?

$completeReport = Join-Path $systemlab 'report-complete.txt'
"My PC system snapshot (Author: Learner)" | Out-File -LiteralPath $completeReport -Encoding UTF8
Get-Date -Format o | Out-File -LiteralPath $completeReport -Append -Encoding UTF8

"=== OS and physical memory (bytes) ===" | Out-File -LiteralPath $completeReport -Append -Encoding UTF8
Get-ComputerInfo -Property OsName, OsVersion, CsTotalPhysicalMemory |
  Format-List OsName, OsVersion, CsTotalPhysicalMemory |
  Out-File -LiteralPath $completeReport -Append -Encoding UTF8 -Width 4096

"=== Top 5 processes by working set (bytes) ===" | Out-File -LiteralPath $completeReport -Append -Encoding UTF8
Get-Process | Sort-Object WorkingSet64 -Descending |
  Select-Object -First 5 ProcessName, Id, WorkingSet64 |
  Format-List | Out-File -LiteralPath $completeReport -Append -Encoding UTF8 -Width 4096

"=== Top 3 processes by cumulative CPU time (seconds) ===" | Out-File -LiteralPath $completeReport -Append -Encoding UTF8
Get-Process | Where-Object {$null -ne $_.CPU} | Sort-Object CPU -Descending |
  Select-Object -First 3 ProcessName, Id, CPU |
  Format-List | Out-File -LiteralPath $completeReport -Append -Encoding UTF8 -Width 4096

$serviceErrors = @()
$serviceSnapshot = @(Get-Service -ErrorAction Continue -ErrorVariable serviceErrors)
"=== Service query ===" | Out-File -LiteralPath $completeReport -Append -Encoding UTF8
"Query errors: $($serviceErrors.Count)" | Out-File -LiteralPath $completeReport -Append -Encoding UTF8
"Running: $(($serviceSnapshot | Where-Object {$_.Status -eq 'Running'} | Measure-Object).Count)" |
  Out-File -LiteralPath $completeReport -Append -Encoding UTF8
"Stopped: $(($serviceSnapshot | Where-Object {$_.Status -eq 'Stopped'} | Measure-Object).Count)" |
  Out-File -LiteralPath $completeReport -Append -Encoding UTF8

"=== FileSystem drives (Used / Free in bytes) ===" | Out-File -LiteralPath $completeReport -Append -Encoding UTF8
Get-PSDrive -PSProvider FileSystem | Format-List Name, Root, Used, Free |
  Out-File -LiteralPath $completeReport -Append -Encoding UTF8 -Width 4096
Get-Content -LiteralPath $completeReport -Encoding UTF8

6. Common Pitfalls and Fixes

Get-ComputerInfo is slow or fails: allow collection time, then inspect the error and affected item. Property selects requested fields but is not a general cure for delay or failure. Treat blank fields as unknown. This Windows-only command is unavailable in PowerShell on other operating systems.

Earlier text disappeared: look for a missing Append in the middle. The complete mission block rebuilds every section from the title to reduce ordering mistakes. Do not practice overwriting important files.

Names end in an ellipsis: Out-File also uses display formatting, so saved text can be truncated. Select the required properties, use Format-List at the final presentation stage, and choose a suitable output width. Reread the file to verify it. Do not sort or filter the original data after Format-List.

Confusing units: 1 GB is 1,000,000,000 bytes; 1 GiB is 1,073,741,824 bytes. PowerShell’s 1GB constant has the latter size, so 16576139264 / 1GB is about 15.44.

Service errors or unfamiliar names: errors mean you should not assume a complete list. Do not stop a service because its name is unfamiliar or a count seems high. Values can change even while collection runs.

$systemlab is empty: a newly opened PowerShell session does not retain these variables. Start again at the setup block in subsection 3-5 to create a new practice folder.

7. Summary

Obtain a list, choose properties, and verify the saved result. Explain values together with collection time, units, and scope. Step 6 extends observation to network information.

Practice verification record

Historical record. The dated record below describes the earlier lesson version. The current instructions include subsequent editorial corrections; that record does not certify every revised example.

On 2026-09-10, every executable block was run in order on Windows 11 using Windows PowerShell 5.1.26100.9444 and PowerShell 7.6.5. Verification covered system queries, both reports and their headings, sections and encoding, and preservation of the basic report when rerunning the full mission. Original reports containing real device details and paths were kept private. This does not validate another PC’s values, permissions, or hardware condition.

Microsoft: Get-ComputerInfo · Get-Service · Get-PSDrive · Out-File · Format-List