Step 5. Collecting System Information — A Health Checkup for My Computer
Level 0 — Understanding How to Operate a Computer and How It’s Structured | Difficulty ★★☆☆☆ | Estimated time: 2–3 hours
Prerequisites: Step 4 complete. We’ll work in Windows PowerShell.
- What you need: a Windows PC, PowerShell.
- Safety: today is an "investigation day." Read-only commands only, so it’s safe.
- Caution: information will pour out like a flood. The goal is not to understand all of it. The goal is to build a map of "which command gives which information."
When a hacker breaches a server, they don’t immediately steal data like in the movies. Most start with reconnaissance (enumeration) — what is this computer for, what’s running on it right now, does the disk have free space. In other words, an attacker’s first skill is "system information gathering." And defenders use the exact same commands as the first step of an incident investigation. Don’t throw away the report you make today — keep it as "a record of my computer’s normal state," a baseline for comparison when something seems off later.
1. Learning Objectives
By the end of this chapter, you can:
- Collect OS and hardware info with
Get-ComputerInfoand pick out only the items you need - Pull and filter lists of running processes and services
- Check free disk space with
Get-PSDrive - Stack collected info into a single file with
Out-File -Appendto build a report
2. Background Knowledge — Today’s Tools and Concepts
Today’s Tools at a Glance
| Category | Details |
|---|---|
| Language/environment | PowerShell 5.1, Windows system information gathering (read-only) |
| Today’s commands | Get-ComputerInfo (OS & hardware), Get-Process (processes), Get-Service (services), Get-PSDrive (disks), Get-Date (time) |
| Review & application | Select-Object (pick columns / trim), Where-Object (filter), Measure-Object (count), Out-File -Append (append) |
| Concepts you need | the 4 major resources (CPU/memory/disk/network), process vs service, baseline (a record of the normal state) |
2-1. The 4 Major Resources of a Computer
"System status" usually means looking at these four:
| Resource | What it does | When it runs out |
|---|---|---|
| CPU | computation/execution | everything slows down |
| Memory (RAM) | workspace | programs die or crawl |
| Disk | storage space | can’t save; logs stop |
| Network | external communication | (formally in Step 6) |
The information we collect today is the "current state" of these four.
2-2. Processes vs Services — Commuters and Residents
- Process: a program running right now. It appears when a user launches it and disappears when closed. (Chrome, Notepad…)
- Service: a program that lives in the background with no screen. It starts automatically at boot and works quietly. (Antivirus, print spooler, Windows Update…)
Why services matter so much in security: they "keep running out of sight." A classic way attackers establish persistence is registering their malware as a service — it comes back to life automatically even after a reboot. That’s why an incident investigation always checks "is there a service I don’t recognize?" Today you’ll learn how to view that list.
2-3. Baselines — The Habit of Recording "Normal"
The defending side does two things. First, record this information in normal times (a baseline). Second, notice changes — "a process I don’t know appeared," "free space suddenly dropped" — by comparing against that record. Big companies do this with automated systems, but the principle is the same as the report you’ll build today.
3. Follow Along
3-1. The Full Checkup — Get-ComputerInfo
Get-ComputerInfo
After a few seconds of thinking, dozens of lines pour out:
WindowsBuildLabEx : 26100.1.amd64fre...
OsName : Microsoft Windows 11 Pro
OsVersion : 10.0.26200
CsManufacturer : ...
CsTotalPhysicalMemory : 16576139264
...
It looks like a flood, but there’s a knack to reading it. The result is entirely a table of name : value. Just find what you need:
OsName— OS name and editionOsVersion— version numberCsTotalPhysicalMemory— actual memory capacity (in bytes, so the number is big. 16,576,139,264 bytes ≈ 16GB)
How to see only what you need (today’s core technique):
Get-ComputerInfo | Select-Object OsName, OsVersion, CsTotalPhysicalMemory
OsName OsVersion CsTotalPhysicalMemory
------ --------- ---------------------
Microsoft Windows 11 Pro 10.0.26200 16576139264
Another trick of Select-Object from Step 3 — "pick only the tags (columns) you want to see." Dozens of lines of flood condensed into a one-line table. The investigative principle for the age of information overload: extract only the columns you need from the start.
3-2. What’s Running Right Now — Top Processes
A combination from Step 3:
Get-Process | Sort-Object WorkingSet -Descending | Select-Object -First 5 ProcessName, WorkingSet
ProcessName WorkingSet
----------- ----------
chrome 892345600
explorer 234567890
...
"The 5 programs eating the most memory." How to read it:
WorkingSetis in bytes. 892,345,600 bytes ≈ 850MB- Usually #1 is the browser (dozens of tabs, each its own process). That’s not weird — it’s normal
Security instinct: if an unfamiliar name ranks high on this list, it’s worth a closer look. You must know the "landscape of normal" to spot the "abnormal." Today’s list is your baseline. If an unknown name shows up, build the habit of searching "process name + what is" — its identity will come out.
3-3. The Resident Roster — Get-Service
Get-Service
Status Name DisplayName
------ ---- -----------
Running AudioEndpointBuilder Windows Audio Endpoint Builder
Stopped AJRouter AllJoyn Router Service
Running BFE Base Filtering Engine
...
How to read it:
Status— Running (resident now) / StoppedName— the short internal nameDisplayName— the long human-friendly name
The full list runs to hundreds. Let’s pick out only what’s running now — Step 3’s filter machine:
Get-Service | Where-Object {$_.Status -eq "Running"}
Only the Running ones remain. This list is "every resident worker on this computer right now."
Predict first: what would
Get-Service | Where-Object {$_.Status -eq "Running"} | Measure-Objecttell you? Predict, then run it.
(Answer: the count of currently running services. On the author’s PC it came out to 148 — anywhere in the 100–200 range is normal depending on installed programs. This number is also a baseline — if it suddenly jumps one day, that’s a signal that "something new got registered.")
3-4. Disk Status — Get-PSDrive
Get-PSDrive
Name Used (GB) Free (GB) Provider Root
---- --------- --------- -------- ----
Alias Alias
C 547.69 376.91 FileSystem C:\
Cert Certificate \
Env Environment
HKCU Registry HKEY_CURRENT_USER
...
You get used/free space per drive. (It’s PowerShell’s design that things beyond the file system — like the registry — also appear "as drives"; for now, just look at the C: line.) Free is the important one — when free space hits bottom, logs stop accumulating, updates fail, and programs die. In practice, shops set criteria like "warn when free space drops below 20%."
3-5. Putting It Together — Building a Report File
Now let’s gather everything we collected into one file. A synthesis of what you learned in Steps 2 and 4:
Get-Date | Out-File report.txt
Get-ComputerInfo | Select-Object OsName, OsVersion, CsTotalPhysicalMemory | Out-File report.txt -Append
Get-Date— the current time (the report’s first line = "time of investigation")Out-File report.txt -Append— -Append is the key: without it, the earlier content gets overwritten. This is "appending."
Keep stacking:
"=== Top 5 processes by memory ===" | Out-File report.txt -Append
Get-Process | Sort-Object WorkingSet -Descending | Select-Object -First 5 ProcessName, WorkingSet | Out-File report.txt -Append
"=== Running service count ===" | Out-File report.txt -Append
(Get-Service | Where-Object {$_.Status -eq "Running"} | Measure-Object).Count | Out-File report.txt -Append
"=== Disks ===" | Out-File report.txt -Append
Get-PSDrive | Out-File report.txt -Append
The (command).Count trick on that last part means "from the result of the command in parentheses, pull out only the Count tag." For now, just type it as-is.
Verify:
Get-Content report.txt
If the time, OS info, process table, service count, and disk table are stacked in order, you’ve succeeded. You just built a one-page system report using only commands.
4. Missions & Exercises
Mission — My PC Health Checkup
Today’s mission is to polish report.txt into something better:
- Put a title line at the top of the report: "My PC Health Checkup (Author: your name)." (Hint: start a fresh file and stack from the first line in order)
- Add a section with the top 3 processes by CPU usage. (Hint:
Sort-Object CPU -Descending) - Count how many stopped (Stopped) services there are and record it.
- Read the finished report with
Get-Content, then explain to family or a friend "what this file shows." If the explanation flows smoothly, you truly understand it. - Keep this file somewhere. A future assignment: make it again with the same commands a month from now and compare.
Exercises
Exercise 1. In Get-ComputerInfo | Select-Object OsName, OsVersion, what is Select-Object’s role?
Exercise 2. State the difference between a process and a service, and one reason services matter especially in security.
Exercise 3. While stacking a report, what happens if you forget -Append on Out-File report.txt?
Exercise 4. In Get-PSDrive output, which number matters most for disk health, and what’s the practical warning threshold?
5. Model Answers & Completion Criteria
Mission Walkthrough
# 1 — start a fresh file (no -Append on the first line)
"My PC Health Checkup (Author: Lee)" | Out-File report.txt
Get-Date | Out-File report.txt -Append
# 2 — top 3 processes by CPU section
"=== Top 3 processes by CPU ===" | Out-File report.txt -Append
Get-Process | Sort-Object CPU -Descending | Select-Object -First 3 ProcessName, CPU | Out-File report.txt -Append
# 3 — stopped service count
"=== Stopped service count ===" | Out-File report.txt -Append
(Get-Service | Where-Object {$_.Status -eq "Stopped"} | Measure-Object).Count | Out-File report.txt -Append
For the remaining sections (OS info, top memory, disks), append the commands from section 3-5 as they are. When done, read the whole thing with Get-Content report.txt — if the title, time, and each section are stacked in order, it’s complete.
Exercise Answers
Answer 1. Out of dozens of items, it shows only the columns (properties) you want to see. It’s a different trick from Step 3’s -First N (count trimming) — this one is "column picking."
Answer 2. A process is a program the user starts and stops; a service is a program that lives in the background with no screen. Why services matter: if an attacker registers malware as a service, it revives automatically after reboot (persistence), so an incident investigation must always check for "unknown services."
Answer 3. That command’s output overwrites the whole file, wiping out everything you stacked. Files that "build up," like reports, always need -Append. Records are stacked, not overwritten.
Answer 4. Free (GB) — free space. When free space bottoms out, logging, updating, and program execution fail. A practical example criterion: "warn below 20% free."
Completion Checklist
- [ ] I can pick out only the items I need from
Get-ComputerInfo - [ ] I can explain the difference between a process and a service
- [ ] I can filter only running services and count them
- [ ] I can check free disk space with
Get-PSDrive - [ ] I can stack multiple pieces of info into one file with
Out-File -Append - [ ] Mission: I completed a one-page health checkup
6. Common Pitfalls & Fixes
Wall 1. Get-ComputerInfo is too slow / throws an error
It’s normal for it to take several seconds to scrape the info together. Occasionally it errors on a specific item; if you need that info, narrow down with Select-Object and try again. And even without this command, alternatives exist like Get-CimInstance Win32_OperatingSystem — for now, just "alternatives exist" is enough.
Wall 2. I used Out-File and the earlier content disappeared
Forgetting -Append means overwrite. Same destructiveness as Set-Content. Making the overwrite mistake once is also good learning.
Wall 3. The table is cut off (names show as …)
PowerShell trimmed the columns to fit the screen width. Attach | Format-Table -AutoSize, or save with Out-File — the file gets the full content. It’s a display issue, not data loss.
Wall 4. The numbers are too big to get a feel for (memory/disk)
That’s because they’re in bytes. Just learn a rough conversion: a billion bytes ≈ 1GB. Later you’ll learn the trick of dividing by /1GB, but for now the instinct of "about 9 zeros means GB scale" is enough.
Wall 5. There are so many service names I can’t tell what matters
You don’t need to know them all. Today’s points are knowing "the command that pulls up the Running list" and the attitude of "if I don’t know it, I can search it." Formally identifying the resident roster is trained in Step 15 (autoruns investigation).
7. Summary
Commands You Learned Today
| Command | Info it gives | Example |
|---|---|---|
Get-ComputerInfo |
OS/hardware overall | | Select-Object OsName, OsVersion |
Get-Process |
running programs | top-N by memory/CPU combos |
Get-Service |
resident services | Where Status -eq Running |
Get-PSDrive |
disk capacity | as-is |
Get-Date |
current time | report’s first line |
Out-File -Append |
append to a file | stacking a report |
Key Concepts
| Concept | One-line summary |
|---|---|
| Process | a program the user launched (commuter) |
| Service | a program living without a screen (resident) |
| 4 major resources | CPU / memory / disk / network |
| Baseline | a record of "normal" — the reference for detecting anomalies |
Instincts That Matter More Than Commands
"Reconnaissance is the first skill attackers and defenders share." And "the more information there is, the more you extract only the columns you need from the start." Don’t throw away today’s report — it’s your computer’s first health checkup and your future comparison baseline.
Today’s three-beat rhythm — "get a list → pick the needed columns → produce a count or total" — is the most reused combination in PowerShell. Processes, services, files, network connections — the target changes, the rhythm stays. In Step 6’s network analysis, you’ll reuse this rhythm as-is.
Once every box is checked, Step 5 is complete. Click the checkbox in the sidebar to save your progress.