<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Analyzing USB Device Artifacts

## reglookup

```bash
reglookup -p "ControlSet001/Enum/USBSTOR" /path/to/SYSTEM
reglookup -p "MountedDevices" /path/to/SYSTEM
reglookup -p "ControlSet001/Enum/USB" /path/to/SYSTEM
```

| Flag | Description |
|------|-------------|
| `-p` | Registry path to query |
| `-t` | Filter by value type |

## RegRipper

```bash
rip.pl -r /path/to/SYSTEM -p usbstor      # USBSTOR plugin
rip.pl -r /path/to/SYSTEM -p mountdev      # MountedDevices
rip.pl -r /path/to/NTUSER.DAT -p mp2       # MountPoints2
rip.pl -r /path/to/SOFTWARE -p emdmgmt     # EMDMgmt (ReadyBoost)
```

## python-registry

```python
from Registry import Registry
reg = Registry.Registry('/path/to/SYSTEM')
key = reg.open('ControlSet001\\Enum\\USBSTOR')
for subkey in key.subkeys():
    print(subkey.name(), subkey.timestamp())
```

## usbrip

```bash
usbrip events history                       # Full USB event history
usbrip events history --column conn --column serial
usbrip ids search --vid 0781 --pid 5567     # VID/PID lookup
usbrip ids download                          # Update USB ID database
```

## Linux USB Logs

```bash
journalctl -k | grep -i "usb\|scsi"
dmesg | grep -i "usb"
grep "usb" /var/log/syslog
lsusb -v                                    # List connected USB devices
```

## USB ID Database

Located at `/usr/share/misc/usb.ids` or `/var/lib/usbutils/usb.ids`.

Format: `VID<TAB>Vendor Name` followed by `<TAB>PID<TAB>Product Name`.

```bash
grep "0781" /usr/share/misc/usb.ids   # SanDisk
grep "0951" /usr/share/misc/usb.ids   # Kingston Technology
```
