<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: analyzing-usb-device-artifacts
description: >-
  USB device forensic analysis including connection history reconstruction,
  device identification via VID/PID lookup, setupapi log parsing, registry
  artifact extraction (USBSTOR, MountedDevices, MountPoints2), and timeline
  correlation of removable media usage for data exfiltration investigations.
domain: cybersecurity
subdomain: digital-forensics
tags:
  - usb-forensics
  - usbstor
  - setupapi
  - device-history
  - vid-pid
  - removable-media
  - data-exfiltration
  - registry-analysis
  - mount-points
  - windows-forensics
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T1052.001", "T1091", "T1200"]
  nist-csf: ["RS.AN-1", "DE.CM-3"]
  frameworks: ["NIST SP 800-86", "SANS FOR500"]
---

# Analyzing USB Device Artifacts

## Overview

USB device artifacts reveal the history of removable media connections
to a system — critical for data exfiltration investigations, insider
threat cases, and malware delivery via USB. This skill covers Windows
registry analysis (USBSTOR, MountedDevices), setupapi log parsing,
Linux USB kernel logs, and VID/PID identification.

## Prerequisites

- Forensic image mounted read-only or registry hive exports
- `reglookup`, `RegRipper`, Python `python-registry`
- `usbrip` for Linux USB history
- Access to USB ID database for VID/PID lookup

```bash
sudo apt install reglookup
pip install python-registry usbrip
```

## Key Concepts

### Windows USB Registry Keys

| Key | Hive | Data |
|-----|------|------|
| `USBSTOR` | SYSTEM | Device class, serial, first/last connected |
| `USB` | SYSTEM | VID/PID of connected devices |
| `MountedDevices` | SYSTEM | Drive letter assignments |
| `MountPoints2` | NTUSER.DAT | Per-user mount point history |
| `EMDMgmt` | SOFTWARE | Volume serial + device serial mapping |
| `DeviceClasses` | SYSTEM | Device interface GUIDs |

### USB Timestamp Sources

| Source | Timestamp Type | Location |
|--------|---------------|----------|
| setupapi.dev.log | First install time | `C:\Windows\inf\setupapi.dev.log` |
| USBSTOR key | First/last connect | SYSTEM hive LastWrite |
| Event Log | Connect/disconnect | System EventLog (Event ID 20001, 10000) |
| Prefetch | First USB-triggered exe | `C:\Windows\Prefetch\` |

## Workflow

### Step 1: Extract USBSTOR Registry Keys

```bash
# Using reglookup on SYSTEM hive
reglookup -p "ControlSet001/Enum/USBSTOR" /mnt/evidence/Windows/System32/config/SYSTEM

# Using RegRipper
rip.pl -r /mnt/evidence/Windows/System32/config/SYSTEM -p usbstor

# Python extraction
python3 -c "
from Registry import Registry
reg = Registry.Registry('/mnt/evidence/Windows/System32/config/SYSTEM')
key = reg.open('ControlSet001\\\\Enum\\\\USBSTOR')
for subkey in key.subkeys():
    print(f'Device: {subkey.name()}')
    for instance in subkey.subkeys():
        print(f'  Serial: {instance.name()}')
        print(f'  LastWrite: {instance.timestamp()}')
"
```

### Step 2: Parse setupapi.dev.log

```bash
# Extract USB device installation timestamps
grep -i "device install.*usbstor" \
  /mnt/evidence/Windows/inf/setupapi.dev.log

# Extract with timestamps
grep -B5 "USBSTOR" /mnt/evidence/Windows/inf/setupapi.dev.log | \
  grep -E "Section start|USBSTOR"

# Parse structured fields
awk '/Section start/{ts=$0} /USBSTOR/{print ts; print $0}' \
  /mnt/evidence/Windows/inf/setupapi.dev.log
```

### Step 3: Map Drive Letters (MountedDevices)

```bash
# Extract MountedDevices from SYSTEM hive
reglookup -p "MountedDevices" /mnt/evidence/Windows/System32/config/SYSTEM

# Decode binary device paths
python3 -c "
from Registry import Registry
reg = Registry.Registry('/mnt/evidence/Windows/System32/config/SYSTEM')
key = reg.open('MountedDevices')
for val in key.values():
    if val.name().startswith('\\\\DosDevices\\\\'):
        raw = val.value()
        try:
            decoded = raw.decode('utf-16-le').rstrip('\\x00')
        except UnicodeDecodeError:
            decoded = raw.hex()
        print(f'{val.name()} -> {decoded}')
"
```

### Step 4: Linux USB History

```bash
# USB connection events from kernel log
journalctl -k | grep -i "usb\|scsi" | grep -i "new\|disconnect"
dmesg | grep -i "usb\|scsi"

# usbrip — comprehensive USB history
usbrip events history
usbrip events history --column conn --column disconn --column serial
usbrip ids search --vid 0781 --pid 5567  # Lookup VID/PID

# udev rules log
grep "usb" /var/log/syslog | grep -i "add\|remove"
```

### Step 5: VID/PID Device Identification

```bash
# Lookup vendor/product from USB ID database
grep "0781" /usr/share/misc/usb.ids   # SanDisk
grep "0951" /usr/share/misc/usb.ids   # Kingston

# Online lookup format: VID_0781&PID_5567
# Parse from USBSTOR: Disk&Ven_SanDisk&Prod_Cruzer&Rev_8.02
```

## Detection

```yaml
title: Usb Device Artifacts Detection
id: 0f23e749-dbf8-4fa4-bb98-bf1f255e3469
status: experimental
description: Detects suspicious activity related to analyzing usb device artifacts techniques in digital forensics context
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine: "*analyzing*usb*"
  condition: selection
level: medium
tags:
  - attack.t1052.001
  - attack.t1091
  - attack.t1200
  - attack.collection
falsepositives:
  - Forensic investigation tools used by authorized incident response team
```

## Verification

- [ ] All USB registry keys extracted (USBSTOR, USB, MountedDevices)
- [ ] setupapi.dev.log parsed for installation timestamps
- [ ] Drive letter assignments correlated with device serials
- [ ] VID/PID identified for all connected devices
- [ ] User-specific mount points extracted from NTUSER.DAT
- [ ] Timeline of USB connections established
- [ ] Correlated with file access timestamps for exfiltration detection

## References

- [SANS USB Device Forensics](https://www.sans.org/blog/usb-device-forensics-tracking-removable-storage/)
- [USB ID Repository](http://www.linux-usb.org/usb-ids.html)
- [usbrip — USB Event Tracking](https://github.com/snovvcrash/usbrip)
- [python-registry](https://github.com/williballenthin/python-registry)
- [RegRipper — USBSTOR Plugin](https://github.com/keydet89/RegRipper3.0)
