USB History Viewing - Revision history

Brad4n6: /* External Links */

2012-01-13T02:44:38Z

‎External Links

Dt: /* External Links */

2011-01-23T03:00:20Z

‎External Links

Dt: /* External Links */

2011-01-21T16:14:30Z

‎External Links

Keydet89: /* External Links */

2008-02-06T14:23:20Z

‎External Links

Aaron at 20:46, 1 February 2008

2008-02-01T20:46:38Z

Keydet89: /* U3-enabled Devices */

2007-08-21T13:31:26Z

‎U3-enabled Devices

Keydet89 at 13:30, 21 August 2007

2007-08-21T13:30:38Z

Jessek: Adding links

2007-08-21T13:14:18Z

Adding links

Jessek: Updated formatting

2007-08-21T13:09:02Z

Updated formatting

Keydet89 at 13:03, 21 August 2007

2007-08-21T13:03:55Z

← Older revision		Revision as of 02:44, 13 January 2012
Line 70:		Line 70:

	* [http://www.tzworks.net/prototype_page.php?proto_id=13 Windows USB Storage (USBSTOR) parser.] Free tool that can be run on Windows, Linux or Mac OS-X. Useful to view when a USB storage device was first installed on a system and what user account(s) were accessing the volume.		* [http://www.tzworks.net/prototype_page.php?proto_id=13 Windows USB Storage (USBSTOR) parser.] Free tool that can be run on Windows, Linux or Mac OS-X. Useful to view when a USB storage device was first installed on a system and what user account(s) were accessing the volume.
		+
		+	*[http://blogs.sans.org/computer-forensics/files/2009/09/USB_Drive_Enclosure-Guide.pdf USB Drive Enclosure Guide] for Windows XP, Vista, and Windows 7.

	[[Category:Howtos]]		[[Category:Howtos]]

@@ Line 69: / Line 69: @@
 * [http://msdn2.microsoft.com/en-us/library/aa906848.aspx UVCView] or the USB Video Class descriptor viewer is a tool in the [[Windows]] Driver Kit (WDK) that allows you to view the descriptors of any attached USB device. It runs on most recent Windows platforms, both 32bit and 64bit.
-* [http://www.tzworks.net/prototype_page.php?proto_id=13 Windows USB Storage (USBSTOR) parser.] Free tool that can be run on Windows, Linux or Mac OS-X
+* [http://www.tzworks.net/prototype_page.php?proto_id=13 Windows USB Storage (USBSTOR) parser.] Free tool that can be run on Windows, Linux or Mac OS-X.  Useful to view when a USB storage device was first installed on a system and what user account(s) were accessing the volume.
 [[Category:Howtos]]

@@ Line 65: / Line 65: @@
 == External Links ==
-[http://www.nirsoft.net/utils/usb_devices_view.html USBDeview] is a tool that automates the viewing of USB device history for Windows 2000/XP/2003/Vista systems. It can recover the device name, description, last plug/unplug date & time, and serial number.
+* [http://www.nirsoft.net/utils/usb_devices_view.html USBDeview] is a tool that automates the viewing of USB device history for Windows 2000/XP/2003/Vista systems. It can recover the device name, description, last plug/unplug date & time, and serial number.
-[http://msdn2.microsoft.com/en-us/library/aa906848.aspx UVCView] or the USB Video Class descriptor viewer is a tool in the [[Windows]] Driver Kit (WDK) that allows you to view the descriptors of any attached USB device. It runs on most recent Windows platforms, both 32bit and 64bit.
+* [http://msdn2.microsoft.com/en-us/library/aa906848.aspx UVCView] or the USB Video Class descriptor viewer is a tool in the [[Windows]] Driver Kit (WDK) that allows you to view the descriptors of any attached USB device. It runs on most recent Windows platforms, both 32bit and 64bit.
 [[Category:Howtos]]

@@ Line 67: / Line 67: @@
 [http://www.nirsoft.net/utils/usb_devices_view.html USBDeview] is a tool that automates the viewing of USB device history for Windows 2000/XP/2003/Vista systems. It can recover the device name, description, last plug/unplug date & time, and serial number.
-[http://msdn2.microsoft.com/en-us/library/aa906848.aspx UVCView] or the USB Video Class descriptor viewer is a tool in the [[Windows]] Driver Kit (WDK) that allows you to view the descriptors of any attached USB device. It runs on most recent windows platforms, both 32bit and 64bit.
+[http://msdn2.microsoft.com/en-us/library/aa906848.aspx UVCView] or the USB Video Class descriptor viewer is a tool in the [[Windows]] Driver Kit (WDK) that allows you to view the descriptors of any attached USB device. It runs on most recent Windows platforms, both 32bit and 64bit.
 [[Category:Howtos]]

← Older revision		Revision as of 20:46, 1 February 2008
Line 66:		Line 66:

	[http://www.nirsoft.net/utils/usb_devices_view.html USBDeview] is a tool that automates the viewing of USB device history for Windows 2000/XP/2003/Vista systems. It can recover the device name, description, last plug/unplug date & time, and serial number.		[http://www.nirsoft.net/utils/usb_devices_view.html USBDeview] is a tool that automates the viewing of USB device history for Windows 2000/XP/2003/Vista systems. It can recover the device name, description, last plug/unplug date & time, and serial number.
		+
		+	[http://msdn2.microsoft.com/en-us/library/aa906848.aspx UVCView] or the USB Video Class descriptor viewer is a tool in the [[Windows]] Driver Kit (WDK) that allows you to view the descriptors of any attached USB device. It runs on most recent windows platforms, both 32bit and 64bit.

	[[Category:Howtos]]		[[Category:Howtos]]

← Older revision		Revision as of 13:31, 21 August 2007
Line 60:		Line 60:

	CdRom&Ven_SanDisk&Prod_U3_Cruzer_Micro&Rev_3.27		CdRom&Ven_SanDisk&Prod_U3_Cruzer_Micro&Rev_3.27
−

	By default, [[Windows]] systems are configured to parse autorun.inf files found in the root of certain media, and to execute the "load=" and "run=" lines of those files for CDFS volumes (among others). However, by default, the systems are configured to NOT execute the "load=" and "run=" lines for autorun.inf files located on removable media, such as thumb drives (this behavior is controlled by a Registry entry and can be modified).		By default, [[Windows]] systems are configured to parse autorun.inf files found in the root of certain media, and to execute the "load=" and "run=" lines of those files for CDFS volumes (among others). However, by default, the systems are configured to NOT execute the "load=" and "run=" lines for autorun.inf files located on removable media, such as thumb drives (this behavior is controlled by a Registry entry and can be modified).

@@ Line 19: / Line 19: @@
 Note: If the second character of the unique instance ID is a '&', then the ID was generated by the system, as the device did not have a serial number.
 == Device Information ==
@@ Line 52: / Line 54: @@
 To determine when the device was last connected to the system, obtain the LastWrite time value from the respective Disk and Volume GUID Registry keys for the device.
 == External Links ==

@@ Line 1: / Line 1: @@
-Microsoft [[Windows]] operating systems records artifacts when USB removable storage devices (thumb drives, iPods, digital cameras, external HDD, etc.) are connected to the system.
+Microsoft [[Windows]] operating systems records artifacts when [[USB]] removable storage devices (thumb drives, iPods, digital cameras, external HDD, etc.) are connected to the system.
 == Plug and Play Manager ==
@@ Line 14: / Line 14: @@
      Disk&Ven_SanDisk&Prod_U3_Cruzer_Micro&Rev_3.27
-This identifies the class of the device.  Beneath this Registry key, a unique instance ID key will be created, using either the serial number retrieved from the device's device descriptor (you can use [http://www.microsoft.com/whdc/device/stream/vidcap/UVCView.mspx UVCView] to view the contents of the device descriptor), or, if the device does not have a serial number, using an identifier generated by the system itself (based on additional information retrieved from the device descriptor, the USB port the device was plugged into, etc...the vendor has not publicized the algorithm used to generate this identifier).  For example:
+This identifies the class of the device.  Beneath this [[Windows Registry|Registry key]], a unique instance ID key will be created, using either the serial number retrieved from the device's device descriptor (you can use [http://www.microsoft.com/whdc/device/stream/vidcap/UVCView.mspx UVCView] to view the contents of the device descriptor), or, if the device does not have a serial number, using an identifier generated by the system itself (based on additional information retrieved from the device descriptor, the USB port the device was plugged into, etc...the vendor has not publicized the algorithm used to generate this identifier).  For example:
      0000161511737EFB&0
@@ Line 40: / Line 40: @@
      {53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
-These are Device Class GUID keys for Disks and Volumes, respectively.  Beneath the Disk GUID key are several subkeys that appear as follows (the key name is wrapped):
+These are Device Class [[Universally Unique Identifier|GUID]] keys for Disks and Volumes, respectively.  Beneath the Disk GUID key are several subkeys that appear as follows (the key name is wrapped):
      ##?#USBSTOR#Disk&Ven_SanDisk&Prod_U3_Cruzer_Micro&Rev_3.27#'''0000161511737EFB&0'''
@@ Line 52: / Line 52: @@
 To determine when the device was last connected to the system, obtain the LastWrite time value from the respective Disk and Volume GUID Registry keys for the device.
 == External Links ==

@@ Line 22: / Line 22: @@
      \??\STORAGE#RemovableMedia#'''7&2c9a320d&0'''&RM#{53f5630d...
-The portion in bold is the ParentIdPrefix.
+The portion in bold is the ParentIdPrefix for the device.
 ----