usbdeviceforensics: extracting USB information from Windows registry hives

usbdeviceforensics is a python script to extract numerous bits of information regarding USB devices. It initially used the information from a SANS blog (Rob Lee) post to retrieve operating system specific information. It now has the ability to process multiple NTUSER.dat registry hives in one go.

The python script was originally a Windows only .Net application but I decided that it was pointless having a GUI for this application.

It should be noted that whilst the information in the blog posting is accurate, there is a caveat to be aware of. During my testing, I have found that an unknown process (probably an update) can update the Date/Time values across all keys, in particular, the USBSTOR keys. Therefore, you could see the same Last Written Date/Time value on each device key. If you see this occurring, then you obviously cannot rely on the values retrieved. All of the dates should be UTC.

Installation

Compilation (Windows)

  1. Install cx_Freeze in the python installation
  2. Run the following command when in the source directory:
    python setup.py build

Download binary

Data Locations

The following outlines the key registry locations that are used to extract the information:

SYSTEM\CurrentControlSet\Enum\USBStor

This location retrieves the Vendor, Product and Version, SerialNo, ParentPrefixId and (USBStor Date/Time).

SYSTEM\CurrentControlSet\Enum\USBSTOR\Disk&Ven_&Prod_yyyy\xxxxx\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\00000064\00000000\Data

This location retrieves a FILETIME value for “Install date”

SYSTEM\CurrentControlSet\Enum\USBSTOR\Disk&Ven_&Prod_yyyy\xxxxx\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\00000065\00000000\Data

This location retrieves a FILETIME value for “First Install Date” of the driver for that USB device

SYSTEM\CurrentControlSet\Enum\USBSTOR\Disk&Ven_&Prod_yyyy\xxxxx\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0066

This location retrieves a FILETIME value for “Last Arrival Date”

SYSTEM\CurrentControlSet\Enum\USBSTOR\Disk&Ven_&Prod_yyyy\xxxxx\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0067

This location retrieves a FILETIME value for “Last Removal Date” of the driver for that USB device

System \CurrentControlSet\Enum\USB

This location retrieves the Vid, Pid and (Enum\USB VIDPID DateTime).

System \CurrentControlSet\Control\DeviceClasses\{53f56307-b6bf-11d0-94f2-00a0c91efb8b}

This location retrieves the (DeviceClasses date/time).

System \MountedDevices

This location retrieves the Drive Letter, Guid and MountPoint

Software\Microsoft\Windows Portable Devices\Devices

This location retrieves the Drive Letter and Volume Name

SOFTWARE\Microsoft\Windows NT\CurrentVersion\EMDMgmt

This location retrieves the Ready Boost related information (Noted from the win4n6 mailing list)

NTUSER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2

This location retrieves the Last Time Connected (MountPoints2 Date/Time)

Setupapi.log/setupapi.dev.log

This file retrieves the Install Date/Time.

If more information is required, then refer to the original SANS blog posting.

Source: https://github.com/woanware/

Share