NoVirusThanks Dos Device Inspector is a lightweight system utility designed to map MS-DOS device symbolic links to their corresponding native NT device paths. It provides visibility into how the Windows Object Manager handles physical hardware and logical drive mappings, making it a valuable tool for system administrators and security researchers. Core Functionality
The tool allows users to inspect the internal relationships between familiar logical drive letters and the underlying system hardware:
Symbolic Link Mapping: It reveals that a standard drive letter, such as C:</code>, is actually a symbolic link that maps to a native NT path like \Device\HarddiskVolume1.
Comprehensive Device Listing: Beyond standard hard drives, it identifies many other “DOS Devices” present in the system, including: CD-ROMs and USB devices.
Custom devices created by drivers to communicate with user-mode applications. Virtual and physical disks. Practical Use Cases
Malware Analysis: Security researchers use it to identify suspicious or non-standard devices that might have been created by malicious drivers.
Forensics & Troubleshooting: It helps in understanding the exact hardware volume associated with a logical drive, which is useful during low-level disk analysis or when resolving complex hardware communication issues.
System Auditing: Admins can use it to see all registered DOS device names to ensure no unauthorized or unexpected virtual devices are active. Availability Developer: NoVirusThanks (an Italian cybersecurity firm).
Subscription Model: NoVirusThanks recently transitioned its software catalog to Appsvoid, a bundle where a single annual subscription provides access to over 30 cybersecurity and system tools.
Are you looking to use this for malware hunting or for general system troubleshooting?
Map Dos Devices to Native NT Paths | Wilders Security Forums
Leave a Reply