<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Analyzing USB Artifacts

## Windows Registry — USBSTOR

```
Path: SYSTEM\CurrentControlSet\Enum\USBSTOR
Structure: USBSTOR\Disk&Ven_<vendor>&Prod_<product>&Rev_<rev>\<serial>
Key timestamp: Last connection time
Values: FriendlyName, ContainerID, DeviceDesc, HardwareID
```

## Windows Registry — USB (VID/PID)

```
Path: SYSTEM\CurrentControlSet\Enum\USB
Structure: USB\VID_<4hex>&PID_<4hex>\<serial>
Lookup: https://the-sz.com/products/usbid/index.php?v=0781&p=5581
```

## Windows Registry — MountedDevices

```
Path: SYSTEM\MountedDevices
Values: \DosDevices\E: → binary data containing device path
Contains USBSTOR path → maps serial to drive letter
```

## setupapi.dev.log

```
Path: C:\Windows\INF\setupapi.dev.log
Format: Device Install entries with timestamps

Example:
>>>  Section start 2026/03/17 14:30:00.000
  cmd: "install" USBSTOR\Disk&Ven_SanDisk&Prod_Ultra&Rev_1.00\4C530012345678
```

Provides **first connection** timestamp (device driver installation).

## Event Logs — USB Events

```
Log: Microsoft-Windows-DriverFrameworks-UserMode/Operational
EID 2003: Device connected (UMDFHostDeviceArrivalBegin)
EID 2100: Device arrival complete
EID 2101: Device removal
EID 2102: Device removal complete

Log: System
EID 20001: Device install (PnP)
EID 10000: Driver package install
```

## RegRipper Plugins

```bash
rip.pl -r SYSTEM -p usbstor       # USB storage devices
rip.pl -r SYSTEM -p mountdev       # Mounted devices
rip.pl -r NTUSER.DAT -p mountpoints2  # User mount points
rip.pl -r SYSTEM -p usbdevices     # USB device details
```

## NirSoft USBDeview

```bash
# Export USB device history to CSV (live system)
USBDeview.exe /scomma usb_history.csv

# Remote system
USBDeview.exe /remote \\target /scomma remote_usb.csv
```

## USB Timeline Correlation

| Artifact | Provides |
|----------|----------|
| setupapi.dev.log | First connection (driver install) |
| USBSTOR key timestamp | Last connection |
| MountPoints2 timestamp | Last user access |
| Event Log 2101 | Last removal |
| Link files (.lnk) | Files accessed from USB drive |
| Recent folder | Files opened from USB path |

## python-registry

```python
from Registry import Registry

reg = Registry.Registry("SYSTEM")
usbstor = reg.open("ControlSet001\\Enum\\USBSTOR")
for device in usbstor.subkeys():
    print(f"Device: {device.name()}")
    for instance in device.subkeys():
        print(f"  Serial: {instance.name()}")
        print(f"  Last connected: {instance.timestamp()}")
```
