This schema was originally developed by The MITRE Corporation. The CybOX XML Schema implementation is maintained by The MITRE Corporation and developed by the open CybOX Community. For more information, including how to get involved in the effort and how to submit change requests, please visit the CybOX website at http://cybox.mitre.org. Win_Volume_Object 2.1 01/22/2014 The following specifies the fields and types that compose this defined CybOX Object type. Each defined object is an extension of the abstract ObjectPropertiesType, defined in CybOX Common. For more information on this extension mechanism, please see the CybOX Specification. This document is intended for developers and assumes some familiarity with XML. Copyright (c) 2012-2014, The MITRE Corporation. All rights reserved. The contents of this file are subject to the terms of the CybOX License located at http://cybox.mitre.org/about/termsofuse.html. See the CybOX License for the specific language governing permissions and limitations for use of this schema. When distributing copies of the CybOX Schema, this license header must be included. Windows_Volume object is intended to characterize Windows disk volumes. This object is roughly based on the Windows Volume Object: http://msdn.microsoft.com/en-us/library/windows/desktop/aa383970(v=vs.85).aspx. The WindowsVolumeObjectType type is intended to characterize Windows disk volumes. Represents the attributes of this windows volume object. Represents the drive letter of this windows volume object. Represents the drive type of this windows volume object. A list of attributes describing this windows volume. Each attribute field represents a single attribute in the windows volume attribute list. WindowsDriveType specifies Windows drive types via a union of the WindowsDriveTypeEnum type and the atomic xs:string type. Its base type is the CybOX Core BaseObjectPropertyType, for permitting complex (i.e. regular-expression based) specifications. This attribute is optional and specifies the expected type for the value of the specified property. WindowsVolumeAttributeType specifies Windows volume attributes via a union of the WindowsVolumeAttributeEnum type and the atomic xs:string type. Its base type is the CybOX Core BaseObjectPropertyType, for permitting complex (i.e. regular-expression based) specifications. This attribute is optional and specifies the expected type for the value of the specified property. This enumeration contains possible drive types, as enumerated by the WINAPI GetDriveType function: http://msdn.microsoft.com/en-us/library/windows/desktop/aa364939(v=vs.85).aspx. The drive type cannot be determined. The root path is invalid; for example, there is no volume mounted at the specified path. The drive has removable media; for example, a floppy drive, thumb drive, or flash card reader. The drive has fixed media; for example, a hard disk drive or flash drive. The drive is a remote (network) drive. The drive is a CD-ROM drive. The drive is a RAM disk. This enumeration is a list of attributes that may be returned by the diskpart attributes command: http://technet.microsoft.com/en-us/library/cc766465(v=ws.10).aspx. Specifies that the volume is read-only. Specifies that the volume is hidden. Specifies that the volume does not receive a drive letter by default. Specifies that the volume is a shadow copy volume.