analyzing-usb-device-connection-history

# Analyzing USB Device Connection History ## When to Use - When investigating potential data exfiltration via removable storage devices - During insider threat investigations to track USB device usage - For compliance audits verifying removable media policy enforcement - When correlating USB connections with file access and copy events - For establishing a timeline of device connections during an incident ## Prerequisites - Forensic image or extracted registry hives and event logs - Access to SYSTEM, SOFTWARE, and NTUSER.DAT registry hives - SetupAPI logs (setupapi.dev.log) - Windows Event Logs (System, Security, DriverFrameworks-UserMode) - USBDeview, USB Forensic Tracker, or RegRipper - Understanding of USB device identification (VID, PID, serial number) ## Workflow ### Step 1: Extract USB-Related Artifacts ```bash # Mount forensic image and copy relevant artifacts mount -o ro,loop,offset=$((2048*512)) /cases/case-2024-001/images/evidence.dd /mnt/evidence mkdir -p /cases/case-2024-001/usb/ # Registry hives cp /mnt/evidence/Windows/System32/config/SYSTEM /cases/case-2024-001/usb/ cp /mnt/evidence/Windows/System32/config/SOFTWARE /cases/case-2024-001/usb/ cp /mnt/evidence/Users/*/NTUSER.DAT /cases/case-2024-001/usb/ # SetupAPI logs (first connection timestamps) cp /mnt/evidence/Windows/INF/setupapi.dev.log /cases/case-2024-001/usb/ # Event logs cp /mnt/evidence/Windows/System32/winevt/Logs/System.evtx /cases/case-2024-001/usb/ cp "/mnt/evidence/Windows/System32/winev...