USB设备连接历史分析
原名：analyzing-usb-device-connection-history
关联 Windows 注册表键（USBSTOR、MountedDevices）与事件日志，以追踪 USB 设备连接历史及系统活动记录。
- 分类
- 开发提效
- 版本
- v1.0
- 作者
- 弈韬(@ra1nzzz)
- 下载
- 1
- 收藏
- 0
- 发布
- 2026-08-18
- 更新
- 2026-08-19
- TRACE 评分
- 4 / 5
内容概览
- When investigating potential data exfiltration via removable storage devices - During insider threat investigations to track USB device usage - For compliance audits verifying removable media policy enforcement - When correlating USB connections with file access and copy events - For establishing a timeline of device connections during an incident - Forensic image or extracted registry hives and event logs - Access to SYSTEM, SOFTWARE, and NTUSER.DAT registry hives - SetupAPI logs (setupapi.dev.log) - Windows Event Logs (System, Security, DriverFrameworks-UserMode) - USBDeview, USB Forensic Tracker, or RegRipper - Understanding of USB device identification (VID, PID, serial number) Concept Description --------- ------------- USBSTOR Registry key storing USB mass storage device identification and connection data VID/PID Vendor ID and Product ID uniquely identifying USB device manufactur…