[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6ADTM4THD52APBH7N815P53":3,"skill-same:01M6ADTM4THD52APBH7N815P53":121},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":58,"commitSha":59,"skillDirectory":60,"forksCount":61,"repositoryHtmlUrl":62,"repositoryHomepageUrl":63,"ownerHtmlUrl":64,"ownerBlogUrl":65,"ownerDescription":66,"updatedAt":67,"install":68,"resources":81},"01M6ADTM4THD52APBH7N815P53","analyzing-usb-device-connection-history",null,"Correlate Windows registry keys (USBSTOR, MountedDevices), Event Logs, and setupapi.dev.log to reconstruct USB device connection history, first\u002Flast-plugged timestamps, and drive letter mappings. Use when investigating removable media usage, tracking device provenance, or building a timeline for suspected data exfiltration.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",35884,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-usb-device-connection-history\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"analyzing","analyzing usb device connection history","cybersecurity","windows","registry","dev","logs","forensics","exfiltration","data-exfiltration","data","usb-forensics","removable-media","registry-analysis","device-history","2026-11-10 10:12:30",false,"---\nname: analyzing-usb-device-connection-history\ndescription: Correlate Windows registry keys (USBSTOR, MountedDevices), Event Logs,\n  and setupapi.dev.log to reconstruct USB device connection history, first\u002Flast-plugged\n  timestamps, and drive letter mappings. Use when investigating removable media usage,\n  tracking device provenance, or building a timeline for suspected data exfiltration.\ndomain: cybersecurity\nsubdomain: digital-forensics\ntags:\n- forensics\n- usb-forensics\n- removable-media\n- registry-analysis\n- data-exfiltration\n- device-history\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- RS.AN-03\n- DE.AE-02\n- RS.MA-01\nmitre_attack:\n- T1052.001\n- T1025\n- T1091\n- T1005\n- T1074.001\n---\n\n# Analyzing USB Device Connection History\n\n## When to Use\n- When investigating potential data exfiltration via removable storage devices\n- During insider threat investigations to track USB device usage\n- For compliance audits verifying removable media policy enforcement\n- When correlating USB connections with file access and copy events\n- For establishing a timeline of device connections during an incident\n\n## Prerequisites\n- Forensic image or extracted registry hives and event logs\n- Access to SYSTEM, SOFTWARE, and NTUSER.DAT registry hives\n- SetupAPI logs (setupapi.dev.log)\n- Windows Event Logs (System, Security, DriverFrameworks-UserMode)\n- USBDeview, USB Forensic Tracker, or RegRipper\n- Understanding of USB device identification (VID, PID, serial number)\n\n## Workflow\n\n### Step 1: Extract USB-Related Artifacts\n\n```bash\n# Mount forensic image and copy relevant artifacts\nmount -o ro,loop,offset=$((2048*512)) \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd \u002Fmnt\u002Fevidence\n\nmkdir -p \u002Fcases\u002Fcase-2024-001\u002Fusb\u002F\n\n# Registry hives\ncp \u002Fmnt\u002Fevidence\u002FWindows\u002FSystem32\u002Fconfig\u002FSYSTEM \u002Fcases\u002Fcase-2024-001\u002Fusb\u002F\ncp \u002Fmnt\u002Fevidence\u002FWindows\u002FSystem32\u002Fconfig\u002FSOFTWARE \u002Fcases\u002Fcase-2024-001\u002Fusb\u002F\ncp \u002Fmnt\u002Fevidence\u002FUsers\u002F*\u002FNTUSER.DAT \u002Fcases\u002Fcase-2024-001\u002Fusb\u002F\n\n# SetupAPI logs (first connection timestamps)\ncp \u002Fmnt\u002Fevidence\u002FWindows\u002FINF\u002Fsetupapi.dev.log \u002Fcases\u002Fcase-2024-001\u002Fusb\u002F\n\n# Event logs\ncp \u002Fmnt\u002Fevidence\u002FWindows\u002FSystem32\u002Fwinevt\u002FLogs\u002FSystem.evtx \u002Fcases\u002Fcase-2024-001\u002Fusb\u002F\ncp \"\u002Fmnt\u002Fevidence\u002FWindows\u002FSystem32\u002Fwinevt\u002FLogs\u002FMicrosoft-Windows-DriverFrameworks-UserMode%4Operational.evtx\" \\\n   \u002Fcases\u002Fcase-2024-001\u002Fusb\u002F 2>\u002Fdev\u002Fnull\ncp \"\u002Fmnt\u002Fevidence\u002FWindows\u002FSystem32\u002Fwinevt\u002FLogs\u002FMicrosoft-Windows-Partition%4Diagnostic.evtx\" \\\n   \u002Fcases\u002Fcase-2024-001\u002Fusb\u002F 2>\u002Fdev\u002Fnull\n```\n\n### Step 2: Parse USBSTOR Registry Key\n\n```bash\n# Extract USBSTOR entries from SYSTEM hive\npython3 \u003C\u003C 'PYEOF'\nfrom Registry import Registry\nimport json\n\nreg = Registry.Registry(\"\u002Fcases\u002Fcase-2024-001\u002Fusb\u002FSYSTEM\")\n\n# Find current ControlSet\nselect = reg.open(\"Select\")\ncurrent = select.value(\"Current\").value()\ncontrolset = f\"ControlSet{current:03d}\"\n\n# Parse USBSTOR\nusbstor_path = f\"{controlset}\\\\Enum\\\\USBSTOR\"\nusbstor = reg.open(usbstor_path)\n\ndevices = []\nprint(\"=== USBSTOR DEVICES ===\\n\")\n\nfor device_class in usbstor.subkeys():\n    # Format: Disk&Ven_VENDOR&Prod_PRODUCT&Rev_REVISION\n    class_name = device_class.name()\n    parts = class_name.split('&')\n    vendor = parts[1].replace('Ven_', '') if len(parts) > 1 else 'Unknown'\n    product = parts[2].replace('Prod_', '') if len(parts) > 2 else 'Unknown'\n    revision = parts[3].replace('Rev_', '') if len(parts) > 3 else 'Unknown'\n\n    for instance in device_class.subkeys():\n        serial = instance.name()\n        last_write = instance.timestamp()\n\n        device_info = {\n            'vendor': vendor,\n            'product': product,\n            'revision': revision,\n            'serial': serial,\n            'last_connected': str(last_write),\n        }\n\n        # Get friendly name if available\n        try:\n            friendly = instance.value(\"FriendlyName\").value()\n            device_info['friendly_name'] = friendly\n        except:\n            pass\n\n        # Get device parameters\n        try:\n            params = instance.subkey(\"Device Parameters\")\n            try:\n                device_info['class_guid'] = params.value(\"ClassGUID\").value()\n            except:\n                pass\n        except:\n            pass\n\n        devices.append(device_info)\n        print(f\"Device: {vendor} {product}\")\n        print(f\"  Serial: {serial}\")\n        print(f\"  Last Connected: {last_write}\")\n        print(f\"  Friendly Name: {device_info.get('friendly_name', 'N\u002FA')}\")\n        print()\n\n# Save results\nwith open('\u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fusb_devices.json', 'w') as f:\n    json.dump(devices, f, indent=2)\n\nprint(f\"\\nTotal USB storage devices found: {len(devices)}\")\nPYEOF\n```\n\n### Step 3: Extract Drive Letter Assignments and User Associations\n\n```bash\n# Parse MountedDevices from SYSTEM hive\npython3 \u003C\u003C 'PYEOF'\nfrom Registry import Registry\nimport struct\n\nreg = Registry.Registry(\"\u002Fcases\u002Fcase-2024-001\u002Fusb\u002FSYSTEM\")\n\nmounted = reg.open(\"MountedDevices\")\n\nprint(\"=== MOUNTED DEVICES (Drive Letter Assignments) ===\\n\")\nfor value in mounted.values():\n    name = value.name()\n    data = value.value()\n\n    if name.startswith(\"\\\\DosDevices\\\\\"):\n        drive_letter = name.replace(\"\\\\DosDevices\\\\\", \"\")\n        if len(data) > 24:\n            # USB device - contains device path string\n            try:\n                device_path = data.decode('utf-16-le').strip('\\x00')\n                if 'USBSTOR' in device_path or 'USB#' in device_path:\n                    print(f\"  {drive_letter} -> {device_path}\")\n            except:\n                pass\n        else:\n            # Fixed disk - contains disk signature + offset\n            disk_sig = struct.unpack('\u003CI', data[0:4])[0]\n            offset = struct.unpack('\u003CQ', data[4:12])[0]\n            print(f\"  {drive_letter} -> Disk Signature: 0x{disk_sig:08X}, Offset: {offset}\")\nPYEOF\n\n# Parse user MountPoints2 (which user accessed which devices)\npython3 \u003C\u003C 'PYEOF'\nfrom Registry import Registry\nimport os, glob\n\nprint(\"\\n=== USER MOUNT POINTS (MountPoints2) ===\\n\")\n\nfor ntuser in glob.glob(\"\u002Fcases\u002Fcase-2024-001\u002Fusb\u002FNTUSER*.DAT\"):\n    try:\n        reg = Registry.Registry(ntuser)\n        mp2 = reg.open(\"Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Explorer\\\\MountPoints2\")\n\n        print(f\"User hive: {os.path.basename(ntuser)}\")\n        for key in mp2.subkeys():\n            guid = key.name()\n            last_write = key.timestamp()\n            if '{' in guid:\n                print(f\"  Volume: {guid} | Last accessed: {last_write}\")\n        print()\n    except Exception as e:\n        print(f\"  Error parsing {ntuser}: {e}\")\nPYEOF\n```\n\n### Step 4: Extract First Connection Timestamps from SetupAPI\n\n```bash\n# Parse setupapi.dev.log for USB device first-install timestamps\npython3 \u003C\u003C 'PYEOF'\nimport re\n\nprint(\"=== SETUPAPI USB DEVICE INSTALLATIONS ===\\n\")\n\nwith open('\u002Fcases\u002Fcase-2024-001\u002Fusb\u002Fsetupapi.dev.log', 'r', errors='ignore') as f:\n    content = f.read()\n\n# Find USB device installation sections\npattern = r'>>>\\s+\\[Device Install.*?\\n.*?Section start (\\d{4}\u002F\\d{2}\u002F\\d{2} \\d{2}:\\d{2}:\\d{2}).*?\\n(.*?)\u003C\u003C\u003C'\nmatches = re.findall(pattern, content, re.DOTALL)\n\nusb_installs = []\nfor timestamp, section in matches:\n    if 'USBSTOR' in section or 'USB\\\\VID' in section:\n        # Extract device ID\n        dev_match = re.search(r'(USBSTOR\\\\[^\\s]+|USB\\\\VID_\\w+&PID_\\w+[^\\s]*)', section)\n        if dev_match:\n            device_id = dev_match.group(1)\n            usb_installs.append({\n                'first_install': timestamp,\n                'device_id': device_id\n            })\n            print(f\"  {timestamp} | {device_id}\")\n\nprint(f\"\\nTotal USB installations found: {len(usb_installs)}\")\nPYEOF\n\n# Parse Windows Event Logs for USB events\n# Event IDs: 2003, 2010, 2100, 2102 (DriverFrameworks-UserMode)\n# Event IDs: 6416 (Security - new external device recognized)\npython3 \u003C\u003C 'PYEOF'\nimport json\nfrom evtx import PyEvtxParser\n\ntry:\n    parser = PyEvtxParser(\"\u002Fcases\u002Fcase-2024-001\u002Fusb\u002FSystem.evtx\")\n\n    print(\"\\n=== SYSTEM EVENT LOG USB EVENTS ===\\n\")\n    for record in parser.records_json():\n        data = json.loads(record['data'])\n        event_id = str(data['Event']['System']['EventID'])\n\n        # USB device connection events\n        if event_id in ('20001', '20003', '10000', '10100'):\n            timestamp = data['Event']['System']['TimeCreated']['#attributes']['SystemTime']\n            event_data = data['Event'].get('UserData', data['Event'].get('EventData', {}))\n            print(f\"  [{timestamp}] EventID {event_id}: {json.dumps(event_data, default=str)[:200]}\")\nexcept Exception as e:\n    print(f\"Error: {e}\")\nPYEOF\n```\n\n### Step 5: Build USB Activity Timeline and Report\n\n```bash\n# Compile all USB evidence into a unified timeline\npython3 \u003C\u003C 'PYEOF'\nimport json, csv\n\ntimeline = []\n\n# Load USBSTOR data\nwith open('\u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fusb_devices.json') as f:\n    devices = json.load(f)\n\nfor device in devices:\n    timeline.append({\n        'timestamp': device['last_connected'],\n        'source': 'USBSTOR Registry',\n        'device': f\"{device['vendor']} {device['product']}\",\n        'serial': device['serial'],\n        'event': 'Last Connected',\n        'detail': device.get('friendly_name', '')\n    })\n\n# Sort chronologically\ntimeline.sort(key=lambda x: x['timestamp'])\n\n# Write timeline CSV\nwith open('\u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fusb_timeline.csv', 'w', newline='') as f:\n    writer = csv.DictWriter(f, fieldnames=['timestamp', 'source', 'device', 'serial', 'event', 'detail'])\n    writer.writeheader()\n    writer.writerows(timeline)\n\nprint(f\"USB Timeline: {len(timeline)} events written to usb_timeline.csv\")\n\n# Print summary\nprint(\"\\n=== USB DEVICE SUMMARY ===\")\nfor entry in timeline:\n    print(f\"  {entry['timestamp']} | {entry['device']} | {entry['serial'][:20]} | {entry['event']}\")\nPYEOF\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| USBSTOR | Registry key storing USB mass storage device identification and connection data |\n| VID\u002FPID | Vendor ID and Product ID uniquely identifying USB device manufacturer and model |\n| Device serial number | Unique identifier for individual USB devices (some devices share serials) |\n| MountedDevices | Registry key mapping volume GUIDs and drive letters to physical devices |\n| MountPoints2 | Per-user registry key showing which volumes a user accessed |\n| SetupAPI log | Windows driver installation log recording first-time device connections |\n| DeviceContainers | Registry key in SOFTWARE hive with device metadata and timestamps |\n| EMDMgmt | Registry key tracking ReadyBoost-compatible devices with serial numbers and timestamps |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| USB Forensic Tracker | Specialized tool for USB device history extraction |\n| USBDeview | NirSoft tool listing all USB devices connected to a system |\n| RegRipper (usbstor plugin) | Automated USB artifact extraction from registry hives |\n| Registry Explorer | Interactive registry analysis for USB-related keys |\n| KAPE | Automated collection of USB-related artifacts |\n| Plaso\u002Flog2timeline | Timeline creation including USB connection events |\n| FTK Imager | Forensic imaging including removable media |\n| Velociraptor | Endpoint agent with USB device history hunting artifacts |\n\n## Common Scenarios\n\n**Scenario 1: Data Exfiltration by Departing Employee**\nExtract USBSTOR entries to identify all USB devices ever connected, correlate device serial numbers with MountPoints2 to confirm user access, cross-reference timestamps with file access logs and jump list recent files, check for large file copy patterns in USN journal.\n\n**Scenario 2: Unauthorized Device on Secure System**\nAudit all USBSTOR entries against approved device list, identify unauthorized devices by VID\u002FPID not matching corporate-approved hardware, determine when the unauthorized device was first and last connected, check if any data was transferred.\n\n**Scenario 3: Malware Delivery via USB**\nIdentify USB device connected just before malware execution (Prefetch timestamps), extract the device serial and vendor information, check if autorun was enabled for the device, look for executable launch from the removable drive letter in Prefetch and ShimCache.\n\n**Scenario 4: Tracking a Specific USB Drive Across Multiple Systems**\nSearch for the same device serial number in USBSTOR across all forensic images, build a map of which systems the drive was connected to and when, identify the chronological path of the device through the organization, correlate with network share access logs.\n\n## Output Format\n\n```\nUSB Device History Analysis:\n  System: DESKTOP-ABC123 (Windows 10 Pro)\n  Total USB Storage Devices: 12\n  Analysis Sources: USBSTOR, MountedDevices, MountPoints2, SetupAPI, Event Logs\n\n  Device Inventory:\n    1. Kingston DataTraveler 3.0 (Serial: 0019E06B4521A2B0)\n       First Connected:  2024-01-10 09:15:32 (SetupAPI)\n       Last Connected:   2024-01-18 14:30:00 (USBSTOR)\n       Drive Letter:     E:\n       User Access:      suspect_user (MountPoints2)\n\n    2. WD My Passport (Serial: 575834314131363035)\n       First Connected:  2024-01-15 20:00:00\n       Last Connected:   2024-01-15 23:45:00\n       Drive Letter:     F:\n       User Access:      suspect_user\n\n  Suspicious Findings:\n    - Kingston drive connected 15 times during investigation period\n    - WD Passport connected only once, late evening (unusual hours)\n    - Unknown device (VID_1234&PID_5678) connected 2024-01-17, no matching approved device\n\n  Timeline: \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fusb_timeline.csv\n```\n","# Analyzing USB Device Connection History\n\n## When to Use\n- When investigating potential data exfiltration via removable storage devices\n- During insider threat investigations to track USB device usage\n- For compliance audits verifying removable media policy enforcement\n- When correlating USB connections with file access and copy events\n- For establishing a timeline of device connections during an incident\n\n## Prerequisites\n- Forensic image or extracted registry hives and event logs\n- Access to SYSTEM, SOFTWARE, and NTUSER.DAT registry hives\n- SetupAPI logs (setupapi.dev.log)\n- Windows Event Logs (System, Security, DriverFrameworks-UserMode)\n- USBDeview, USB Forensic Tracker, or RegRipper\n- Understanding of USB device identification (VID, PID, serial number)\n\n## Workflow\n\n### Step 1: Extract USB-Related Artifacts\n\n```bash\n# Mount forensic image and copy relevant artifacts\nmount -o ro,loop,offset=$((2048*512)) \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd \u002Fmnt\u002Fevidence\n\nmkdir -p \u002Fcases\u002Fcase-2024-001\u002Fusb\u002F\n\n# Registry hives\ncp \u002Fmnt\u002Fevidence\u002FWindows\u002FSystem32\u002Fconfig\u002FSYSTEM \u002Fcases\u002Fcase-2024-001\u002Fusb\u002F\ncp \u002Fmnt\u002Fevidence\u002FWindows\u002FSystem32\u002Fconfig\u002FSOFTWARE \u002Fcases\u002Fcase-2024-001\u002Fusb\u002F\ncp \u002Fmnt\u002Fevidence\u002FUsers\u002F*\u002FNTUSER.DAT \u002Fcases\u002Fcase-2024-001\u002Fusb\u002F\n\n# SetupAPI logs (first connection timestamps)\ncp \u002Fmnt\u002Fevidence\u002FWindows\u002FINF\u002Fsetupapi.dev.log \u002Fcases\u002Fcase-2024-001\u002Fusb\u002F\n\n# Event logs\ncp \u002Fmnt\u002Fevidence\u002FWindows\u002FSystem32\u002Fwinevt\u002FLogs\u002FSystem.evtx \u002Fcases\u002Fcase-2024-001\u002Fusb\u002F\ncp \"\u002Fmnt\u002Fevidence\u002FWindows\u002FSystem32\u002Fwinevt\u002FLogs\u002FMicrosoft-Windows-DriverFrameworks-UserMode%4Operational.evtx\" \\\n   \u002Fcases\u002Fcase-2024-001\u002Fusb\u002F 2>\u002Fdev\u002Fnull\ncp \"\u002Fmnt\u002Fevidence\u002FWindows\u002FSystem32\u002Fwinevt\u002FLogs\u002FMicrosoft-Windows-Partition%4Diagnostic.evtx\" \\\n   \u002Fcases\u002Fcase-2024-001\u002Fusb\u002F 2>\u002Fdev\u002Fnull\n```\n\n### Step 2: Parse USBSTOR Registry Key\n\n```bash\n# Extract USBSTOR entries from SYSTEM hive\npython3 \u003C\u003C 'PYEOF'\nfrom Registry import Registry\nimport json\n\nreg = Registry.Registry(\"\u002Fcases\u002Fcase-2024-001\u002Fusb\u002FSYSTEM\")\n\n# Find current ControlSet\nselect = reg.open(\"Select\")\ncurrent = select.value(\"Current\").value()\ncontrolset = f\"ControlSet{current:03d}\"\n\n# Parse USBSTOR\nusbstor_path = f\"{controlset}\\\\Enum\\\\USBSTOR\"\nusbstor = reg.open(usbstor_path)\n\ndevices = []\nprint(\"=== USBSTOR DEVICES ===\\n\")\n\nfor device_class in usbstor.subkeys():\n    # Format: Disk&Ven_VENDOR&Prod_PRODUCT&Rev_REVISION\n    class_name = device_class.name()\n    parts = class_name.split('&')\n    vendor = parts[1].replace('Ven_', '') if len(parts) > 1 else 'Unknown'\n    product = parts[2].replace('Prod_', '') if len(parts) > 2 else 'Unknown'\n    revision = parts[3].replace('Rev_', '') if len(parts) > 3 else 'Unknown'\n\n    for instance in device_class.subkeys():\n        serial = instance.name()\n        last_write = instance.timestamp()\n\n        device_info = {\n            'vendor': vendor,\n            'product': product,\n            'revision': revision,\n            'serial': serial,\n            'last_connected': str(last_write),\n        }\n\n        # Get friendly name if available\n        try:\n            friendly = instance.value(\"FriendlyName\").value()\n            device_info['friendly_name'] = friendly\n        except:\n            pass\n\n        # Get device parameters\n        try:\n            params = instance.subkey(\"Device Parameters\")\n            try:\n                device_info['class_guid'] = params.value(\"ClassGUID\").value()\n            except:\n                pass\n        except:\n            pass\n\n        devices.append(device_info)\n        print(f\"Device: {vendor} {product}\")\n        print(f\"  Serial: {serial}\")\n        print(f\"  Last Connected: {last_write}\")\n        print(f\"  Friendly Name: {device_info.get('friendly_name', 'N\u002FA')}\")\n        print()\n\n# Save results\nwith open('\u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fusb_devices.json', 'w') as f:\n    json.dump(devices, f, indent=2)\n\nprint(f\"\\nTotal USB storage devices found: {len(devices)}\")\nPYEOF\n```\n\n### Step 3: Extract Drive Letter Assignments and User Associations\n\n```bash\n# Parse MountedDevices from SYSTEM hive\npython3 \u003C\u003C 'PYEOF'\nfrom Registry import Registry\nimport struct\n\nreg = Registry.Registry(\"\u002Fcases\u002Fcase-2024-001\u002Fusb\u002FSYSTEM\")\n\nmounted = reg.open(\"MountedDevices\")\n\nprint(\"=== MOUNTED DEVICES (Drive Letter Assignments) ===\\n\")\nfor value in mounted.values():\n    name = value.name()\n    data = value.value()\n\n    if name.startswith(\"\\\\DosDevices\\\\\"):\n        drive_letter = name.replace(\"\\\\DosDevices\\\\\", \"\")\n        if len(data) > 24:\n            # USB device - contains device path string\n            try:\n                device_path = data.decode('utf-16-le').strip('\\x00')\n                if 'USBSTOR' in device_path or 'USB#' in device_path:\n                    print(f\"  {drive_letter} -> {device_path}\")\n            except:\n                pass\n        else:\n            # Fixed disk - contains disk signature + offset\n            disk_sig = struct.unpack('\u003CI', data[0:4])[0]\n            offset = struct.unpack('\u003CQ', data[4:12])[0]\n            print(f\"  {drive_letter} -> Disk Signature: 0x{disk_sig:08X}, Offset: {offset}\")\nPYEOF\n\n# Parse user MountPoints2 (which user accessed which devices)\npython3 \u003C\u003C 'PYEOF'\nfrom Registry import Registry\nimport os, glob\n\nprint(\"\\n=== USER MOUNT POINTS (MountPoints2) ===\\n\")\n\nfor ntuser in glob.glob(\"\u002Fcases\u002Fcase-2024-001\u002Fusb\u002FNTUSER*.DAT\"):\n    try:\n        reg = Registry.Registry(ntuser)\n        mp2 = reg.open(\"Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Explorer\\\\MountPoints2\")\n\n        print(f\"User hive: {os.path.basename(ntuser)}\")\n        for key in mp2.subkeys():\n            guid = key.name()\n            last_write = key.timestamp()\n            if '{' in guid:\n                print(f\"  Volume: {guid} | Last accessed: {last_write}\")\n        print()\n    except Exception as e:\n        print(f\"  Error parsing {ntuser}: {e}\")\nPYEOF\n```\n\n### Step 4: Extract First Connection Timestamps from SetupAPI\n\n```bash\n# Parse setupapi.dev.log for USB device first-install timestamps\npython3 \u003C\u003C 'PYEOF'\nimport re\n\nprint(\"=== SETUPAPI USB DEVICE INSTALLATIONS ===\\n\")\n\nwith open('\u002Fcases\u002Fcase-2024-001\u002Fusb\u002Fsetupapi.dev.log', 'r', errors='ignore') as f:\n    content = f.read()\n\n# Find USB device installation sections\npattern = r'>>>\\s+\\[Device Install.*?\\n.*?Section start (\\d{4}\u002F\\d{2}\u002F\\d{2} \\d{2}:\\d{2}:\\d{2}).*?\\n(.*?)\u003C\u003C\u003C'\nmatches = re.findall(pattern, content, re.DOTALL)\n\nusb_installs = []\nfor timestamp, section in matches:\n    if 'USBSTOR' in section or 'USB\\\\VID' in section:\n        # Extract device ID\n        dev_match = re.search(r'(USBSTOR\\\\[^\\s]+|USB\\\\VID_\\w+&PID_\\w+[^\\s]*)', section)\n        if dev_match:\n            device_id = dev_match.group(1)\n            usb_installs.append({\n                'first_install': timestamp,\n                'device_id': device_id\n            })\n            print(f\"  {timestamp} | {device_id}\")\n\nprint(f\"\\nTotal USB installations found: {len(usb_installs)}\")\nPYEOF\n\n# Parse Windows Event Logs for USB events\n# Event IDs: 2003, 2010, 2100, 2102 (DriverFrameworks-UserMode)\n# Event IDs: 6416 (Security - new external device recognized)\npython3 \u003C\u003C 'PYEOF'\nimport json\nfrom evtx import PyEvtxParser\n\ntry:\n    parser = PyEvtxParser(\"\u002Fcases\u002Fcase-2024-001\u002Fusb\u002FSystem.evtx\")\n\n    print(\"\\n=== SYSTEM EVENT LOG USB EVENTS ===\\n\")\n    for record in parser.records_json():\n        data = json.loads(record['data'])\n        event_id = str(data['Event']['System']['EventID'])\n\n        # USB device connection events\n        if event_id in ('20001', '20003', '10000', '10100'):\n            timestamp = data['Event']['System']['TimeCreated']['#attributes']['SystemTime']\n            event_data = data['Event'].get('UserData', data['Event'].get('EventData', {}))\n            print(f\"  [{timestamp}] EventID {event_id}: {json.dumps(event_data, default=str)[:200]}\")\nexcept Exception as e:\n    print(f\"Error: {e}\")\nPYEOF\n```\n\n### Step 5: Build USB Activity Timeline and Report\n\n```bash\n# Compile all USB evidence into a unified timeline\npython3 \u003C\u003C 'PYEOF'\nimport json, csv\n\ntimeline = []\n\n# Load USBSTOR data\nwith open('\u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fusb_devices.json') as f:\n    devices = json.load(f)\n\nfor device in devices:\n    timeline.append({\n        'timestamp': device['last_connected'],\n        'source': 'USBSTOR Registry',\n        'device': f\"{device['vendor']} {device['product']}\",\n        'serial': device['serial'],\n        'event': 'Last Connected',\n        'detail': device.get('friendly_name', '')\n    })\n\n# Sort chronologically\ntimeline.sort(key=lambda x: x['timestamp'])\n\n# Write timeline CSV\nwith open('\u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fusb_timeline.csv', 'w', newline='') as f:\n    writer = csv.DictWriter(f, fieldnames=['timestamp', 'source', 'device', 'serial', 'event', 'detail'])\n    writer.writeheader()\n    writer.writerows(timeline)\n\nprint(f\"USB Timeline: {len(timeline)} events written to usb_timeline.csv\")\n\n# Print summary\nprint(\"\\n=== USB DEVICE SUMMARY ===\")\nfor entry in timeline:\n    print(f\"  {entry['timestamp']} | {entry['device']} | {entry['serial'][:20]} | {entry['event']}\")\nPYEOF\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| USBSTOR | Registry key storing USB mass storage device identification and connection data |\n| VID\u002FPID | Vendor ID and Product ID uniquely identifying USB device manufacturer and model |\n| Device serial number | Unique identifier for individual USB devices (some devices share serials) |\n| MountedDevices | Registry key mapping volume GUIDs and drive letters to physical devices |\n| MountPoints2 | Per-user registry key showing which volumes a user accessed |\n| SetupAPI log | Windows driver installation log recording first-time device connections |\n| DeviceContainers | Registry key in SOFTWARE hive with device metadata and timestamps |\n| EMDMgmt | Registry key tracking ReadyBoost-compatible devices with serial numbers and timestamps |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| USB Forensic Tracker | Specialized tool for USB device history extraction |\n| USBDeview | NirSoft tool listing all USB devices connected to a system |\n| RegRipper (usbstor plugin) | Automated USB artifact extraction from registry hives |\n| Registry Explorer | Interactive registry analysis for USB-related keys |\n| KAPE | Automated collection of USB-related artifacts |\n| Plaso\u002Flog2timeline | Timeline creation including USB connection events |\n| FTK Imager | Forensic imaging including removable media |\n| Velociraptor | Endpoint agent with USB device history hunting artifacts |\n\n## Common Scenarios\n\n**Scenario 1: Data Exfiltration by Departing Employee**\nExtract USBSTOR entries to identify all USB devices ever connected, correlate device serial numbers with MountPoints2 to confirm user access, cross-reference timestamps with file access logs and jump list recent files, check for large file copy patterns in USN journal.\n\n**Scenario 2: Unauthorized Device on Secure System**\nAudit all USBSTOR entries against approved device list, identify unauthorized devices by VID\u002FPID not matching corporate-approved hardware, determine when the unauthorized device was first and last connected, check if any data was transferred.\n\n**Scenario 3: Malware Delivery via USB**\nIdentify USB device connected just before malware execution (Prefetch timestamps), extract the device serial and vendor information, check if autorun was enabled for the device, look for executable launch from the removable drive letter in Prefetch and ShimCache.\n\n**Scenario 4: Tracking a Specific USB Drive Across Multiple Systems**\nSearch for the same device serial number in USBSTOR across all forensic images, build a map of which systems the drive was connected to and when, identify the chronological path of the device through the organization, correlate with network share access logs.\n\n## Output Format\n\n```\nUSB Device History Analysis:\n  System: DESKTOP-ABC123 (Windows 10 Pro)\n  Total USB Storage Devices: 12\n  Analysis Sources: USBSTOR, MountedDevices, MountPoints2, SetupAPI, Event Logs\n\n  Device Inventory:\n    1. Kingston DataTraveler 3.0 (Serial: 0019E06B4521A2B0)\n       First Connected:  2024-01-10 09:15:32 (SetupAPI)\n       Last Connected:   2024-01-18 14:30:00 (USBSTOR)\n       Drive Letter:     E:\n       User Access:      suspect_user (MountPoints2)\n\n    2. WD My Passport (Serial: 575834314131363035)\n       First Connected:  2024-01-15 20:00:00\n       Last Connected:   2024-01-15 23:45:00\n       Drive Letter:     F:\n       User Access:      suspect_user\n\n  Suspicious Findings:\n    - Kingston drive connected 15 times during investigation period\n    - WD Passport connected only once, late evening (unusual hours)\n    - Unknown device (VID_1234&PID_5678) connected 2024-01-17, no matching approved device\n\n  Timeline: \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fusb_timeline.csv\n```\n",{"name":5,"tags":44,"author":45,"domain":26,"license":15,"version":46,"nist_csf":47,"subdomain":51,"description":7,"mitre_attack":52},[31,35,36,37,33,38],"mahipal","1.0",[48,49,50],"RS.AN-03","DE.AE-02","RS.MA-01","digital-forensics",[53,54,55,56,57],"T1052.001","T1025","T1091","T1005","T1074.001","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fanalyzing-usb-device-connection-history",4379,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":69,"prompt":79,"zipAvailable":80},[70,73,76],{"tool":71,"command":72},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill analyzing-usb-device-connection-history",{"tool":74,"command":75},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill analyzing-usb-device-connection-history",{"tool":77,"command":78},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill analyzing-usb-device-connection-history","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-usb-device-connection-history\u002FSKILL.md",true,[82,88,93,97,103,107,111,117],{"path":83,"resourceType":84,"resourceTypeDesc":85,"sizeBytes":86,"sourceHtmlUrl":87},"dx-hall-of-fame.md","REFERENCE","参考文档",7285,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fgstack\u002Fplan-devex-review\u002Fdx-hall-of-fame.md",{"path":89,"resourceType":89,"resourceTypeDesc":90,"sizeBytes":91,"sourceHtmlUrl":92},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-usb-device-connection-history\u002FLICENSE",{"path":94,"resourceType":84,"resourceTypeDesc":85,"sizeBytes":95,"sourceHtmlUrl":96},"references\u002Fapi-reference.md",2194,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-usb-device-connection-history\u002Freferences\u002Fapi-reference.md",{"path":98,"resourceType":99,"resourceTypeDesc":100,"sizeBytes":101,"sourceHtmlUrl":102},"scripts\u002Fagent.py","SCRIPT","脚本",6587,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-usb-device-connection-history\u002Fscripts\u002Fagent.py",{"path":104,"resourceType":84,"resourceTypeDesc":85,"sizeBytes":105,"sourceHtmlUrl":106},"sections\u002Fmanifest.json",547,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fgstack\u002Fplan-devex-review\u002Fsections\u002Fmanifest.json",{"path":108,"resourceType":84,"resourceTypeDesc":85,"sizeBytes":109,"sourceHtmlUrl":110},"sections\u002Freview-sections.md",46012,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fgstack\u002Fplan-devex-review\u002Fsections\u002Freview-sections.md",{"path":112,"resourceType":113,"resourceTypeDesc":114,"sizeBytes":115,"sourceHtmlUrl":116},"sections\u002Freview-sections.md.tmpl","OTHER","其他",18128,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fgstack\u002Fplan-devex-review\u002Fsections\u002Freview-sections.md.tmpl",{"path":118,"resourceType":113,"resourceTypeDesc":114,"sizeBytes":119,"sourceHtmlUrl":120},"SKILL.md.tmpl",18838,"https:\u002F\u002Fgithub.com\u002Fshengdabai\u002FTony-Claude-Code-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fgstack\u002Fplan-devex-review\u002FSKILL.md.tmpl",[122,149,173,201,222,249],{"skillNo":123,"name":124,"nameZh":6,"description":125,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":126,"categories":127,"keywords":129,"publishedAt":39},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[128],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[130,131,132,133,134,26,135,136,137,138,139,140,141,142,143,144,145,146,147,148],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","identity","pr","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":150,"name":151,"nameZh":6,"description":152,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":153,"categories":154,"keywords":156,"publishedAt":39},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[155],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[157,145,158,159,134,160,26,137,161,162,163,164,165,166,167,168,169,170,171,172],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":174,"name":175,"nameZh":6,"description":176,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":177,"categories":178,"keywords":183,"publishedAt":39},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[179,182],{"categoryNo":180,"categoryName":181,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[167,184,185,186,187,26,188,189,161,190,191,192,193,194,195,196,197,198,199,200],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":202,"name":203,"nameZh":6,"description":204,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":205,"categories":206,"keywords":208,"publishedAt":39},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[207],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[27,209,210,26,28,211,30,212,213,214,215,34,216,217,51,218,164,219,220,221],"kape","triaging windows with kape","browser","windows-forensics","dfir","mft","mftecmd","prefetch","eric-zimmerman","SET","collection","pecmd","artifact-collection",{"skillNo":223,"name":224,"nameZh":6,"description":225,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":226,"categories":227,"keywords":229,"publishedAt":39},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[228],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[230,231,232,26,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":250,"name":251,"nameZh":6,"description":252,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":253,"categories":254,"keywords":256,"publishedAt":39},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[255],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[134,257,26,258,259,260,261,262,263,264,265,196,266,197,267,268,269,270,271,272],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]