[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6ESSQ3HKJA0QJKDB93AMY41":3,"skill-same:01M6ESSQ3HKJA0QJKDB93AMY41":107},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":64,"commitSha":65,"skillDirectory":66,"forksCount":14,"repositoryHtmlUrl":67,"repositoryHomepageUrl":68,"ownerHtmlUrl":69,"ownerBlogUrl":6,"ownerDescription":70,"updatedAt":71,"install":72,"resources":85},"01M6ESSQ3HKJA0QJKDB93AMY41","analyzing-usb-device-connection-history",null,"Investigate USB device connection history from Windows registry, event logs, and setupapi logs to track removable media usage and potential data exfiltration.","henriquescastilho\u002Fmy-claude","henriquescastilho","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F153296945?v=4","01M6ESH7EXPXTH9CVQ4K16SRG8","Henrique Scheer","01M6ESH7JHEK2PTNNH4HEH787Z",0,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fanalyzing-usb-device-connection-history\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"device","history","analyzing","analyzing usb device connection history","registry-analysis","event","de","investigate","Media","analysis","device-history","cybersecurity","removable-media","usb-forensics","data","data-exfiltration","exfiltration","forensics","logs","windows","2026-11-10 10:12:30",false,"---\nname: analyzing-usb-device-connection-history\ndescription: Investigate USB device connection history from Windows registry, event\n  logs, and setupapi logs to track removable media usage and potential data exfiltration.\ndomain: cybersecurity\nsubdomain: digital-forensics\ntags:\n- forensics\n- usb-forensics\n- removable-media\n- registry-analysis\n- data-exfiltration\n- device-history\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- RS.AN-01\n- RS.AN-03\n- DE.AE-02\n- RS.MA-01\nmitre_attack:\n- T1052.001\n- T1025\n- T1091\n- T1005\n- T1074.001\n---\n\n# Analyzing USB Device Connection History\n\n## When to Use\n- When investigating potential data exfiltration via removable storage devices\n- During insider threat investigations to track USB device usage\n- For compliance audits verifying removable media policy enforcement\n- When correlating USB connections with file access and copy events\n- For establishing a timeline of device connections during an incident\n\n## Prerequisites\n- Forensic image or extracted registry hives and event logs\n- Access to SYSTEM, SOFTWARE, and NTUSER.DAT registry hives\n- SetupAPI logs (setupapi.dev.log)\n- Windows Event Logs (System, Security, DriverFrameworks-UserMode)\n- USBDeview, USB Forensic Tracker, or RegRipper\n- Understanding of USB device identification (VID, PID, serial number)\n\n## Workflow\n\n### Step 1: Extract USB-Related Artifacts\n\n```bash\n# Mount forensic image and copy relevant artifacts\nmount -o ro,loop,offset=$((2048*512)) \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd \u002Fmnt\u002Fevidence\n\nmkdir -p \u002Fcases\u002Fcase-2024-001\u002Fusb\u002F\n\n# Registry hives\ncp \u002Fmnt\u002Fevidence\u002FWindows\u002FSystem32\u002Fconfig\u002FSYSTEM \u002Fcases\u002Fcase-2024-001\u002Fusb\u002F\ncp \u002Fmnt\u002Fevidence\u002FWindows\u002FSystem32\u002Fconfig\u002FSOFTWARE \u002Fcases\u002Fcase-2024-001\u002Fusb\u002F\ncp \u002Fmnt\u002Fevidence\u002FUsers\u002F*\u002FNTUSER.DAT \u002Fcases\u002Fcase-2024-001\u002Fusb\u002F\n\n# SetupAPI logs (first connection timestamps)\ncp \u002Fmnt\u002Fevidence\u002FWindows\u002FINF\u002Fsetupapi.dev.log \u002Fcases\u002Fcase-2024-001\u002Fusb\u002F\n\n# Event logs\ncp \u002Fmnt\u002Fevidence\u002FWindows\u002FSystem32\u002Fwinevt\u002FLogs\u002FSystem.evtx \u002Fcases\u002Fcase-2024-001\u002Fusb\u002F\ncp \"\u002Fmnt\u002Fevidence\u002FWindows\u002FSystem32\u002Fwinevt\u002FLogs\u002FMicrosoft-Windows-DriverFrameworks-UserMode%4Operational.evtx\" \\\n   \u002Fcases\u002Fcase-2024-001\u002Fusb\u002F 2>\u002Fdev\u002Fnull\ncp \"\u002Fmnt\u002Fevidence\u002FWindows\u002FSystem32\u002Fwinevt\u002FLogs\u002FMicrosoft-Windows-Partition%4Diagnostic.evtx\" \\\n   \u002Fcases\u002Fcase-2024-001\u002Fusb\u002F 2>\u002Fdev\u002Fnull\n```\n\n### Step 2: Parse USBSTOR Registry Key\n\n```bash\n# Extract USBSTOR entries from SYSTEM hive\npython3 \u003C\u003C 'PYEOF'\nfrom Registry import Registry\nimport json\n\nreg = Registry.Registry(\"\u002Fcases\u002Fcase-2024-001\u002Fusb\u002FSYSTEM\")\n\n# Find current ControlSet\nselect = reg.open(\"Select\")\ncurrent = select.value(\"Current\").value()\ncontrolset = f\"ControlSet{current:03d}\"\n\n# Parse USBSTOR\nusbstor_path = f\"{controlset}\\\\Enum\\\\USBSTOR\"\nusbstor = reg.open(usbstor_path)\n\ndevices = []\nprint(\"=== USBSTOR DEVICES ===\\n\")\n\nfor device_class in usbstor.subkeys():\n    # Format: Disk&Ven_VENDOR&Prod_PRODUCT&Rev_REVISION\n    class_name = device_class.name()\n    parts = class_name.split('&')\n    vendor = parts[1].replace('Ven_', '') if len(parts) > 1 else 'Unknown'\n    product = parts[2].replace('Prod_', '') if len(parts) > 2 else 'Unknown'\n    revision = parts[3].replace('Rev_', '') if len(parts) > 3 else 'Unknown'\n\n    for instance in device_class.subkeys():\n        serial = instance.name()\n        last_write = instance.timestamp()\n\n        device_info = {\n            'vendor': vendor,\n            'product': product,\n            'revision': revision,\n            'serial': serial,\n            'last_connected': str(last_write),\n        }\n\n        # Get friendly name if available\n        try:\n            friendly = instance.value(\"FriendlyName\").value()\n            device_info['friendly_name'] = friendly\n        except:\n            pass\n\n        # Get device parameters\n        try:\n            params = instance.subkey(\"Device Parameters\")\n            try:\n                device_info['class_guid'] = params.value(\"ClassGUID\").value()\n            except:\n                pass\n        except:\n            pass\n\n        devices.append(device_info)\n        print(f\"Device: {vendor} {product}\")\n        print(f\"  Serial: {serial}\")\n        print(f\"  Last Connected: {last_write}\")\n        print(f\"  Friendly Name: {device_info.get('friendly_name', 'N\u002FA')}\")\n        print()\n\n# Save results\nwith open('\u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fusb_devices.json', 'w') as f:\n    json.dump(devices, f, indent=2)\n\nprint(f\"\\nTotal USB storage devices found: {len(devices)}\")\nPYEOF\n```\n\n### Step 3: Extract Drive Letter Assignments and User Associations\n\n```bash\n# Parse MountedDevices from SYSTEM hive\npython3 \u003C\u003C 'PYEOF'\nfrom Registry import Registry\nimport struct\n\nreg = Registry.Registry(\"\u002Fcases\u002Fcase-2024-001\u002Fusb\u002FSYSTEM\")\n\nmounted = reg.open(\"MountedDevices\")\n\nprint(\"=== MOUNTED DEVICES (Drive Letter Assignments) ===\\n\")\nfor value in mounted.values():\n    name = value.name()\n    data = value.value()\n\n    if name.startswith(\"\\\\DosDevices\\\\\"):\n        drive_letter = name.replace(\"\\\\DosDevices\\\\\", \"\")\n        if len(data) > 24:\n            # USB device - contains device path string\n            try:\n                device_path = data.decode('utf-16-le').strip('\\x00')\n                if 'USBSTOR' in device_path or 'USB#' in device_path:\n                    print(f\"  {drive_letter} -> {device_path}\")\n            except:\n                pass\n        else:\n            # Fixed disk - contains disk signature + offset\n            disk_sig = struct.unpack('\u003CI', data[0:4])[0]\n            offset = struct.unpack('\u003CQ', data[4:12])[0]\n            print(f\"  {drive_letter} -> Disk Signature: 0x{disk_sig:08X}, Offset: {offset}\")\nPYEOF\n\n# Parse user MountPoints2 (which user accessed which devices)\npython3 \u003C\u003C 'PYEOF'\nfrom Registry import Registry\nimport os, glob\n\nprint(\"\\n=== USER MOUNT POINTS (MountPoints2) ===\\n\")\n\nfor ntuser in glob.glob(\"\u002Fcases\u002Fcase-2024-001\u002Fusb\u002FNTUSER*.DAT\"):\n    try:\n        reg = Registry.Registry(ntuser)\n        mp2 = reg.open(\"Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Explorer\\\\MountPoints2\")\n\n        print(f\"User hive: {os.path.basename(ntuser)}\")\n        for key in mp2.subkeys():\n            guid = key.name()\n            last_write = key.timestamp()\n            if '{' in guid:\n                print(f\"  Volume: {guid} | Last accessed: {last_write}\")\n        print()\n    except Exception as e:\n        print(f\"  Error parsing {ntuser}: {e}\")\nPYEOF\n```\n\n### Step 4: Extract First Connection Timestamps from SetupAPI\n\n```bash\n# Parse setupapi.dev.log for USB device first-install timestamps\npython3 \u003C\u003C 'PYEOF'\nimport re\n\nprint(\"=== SETUPAPI USB DEVICE INSTALLATIONS ===\\n\")\n\nwith open('\u002Fcases\u002Fcase-2024-001\u002Fusb\u002Fsetupapi.dev.log', 'r', errors='ignore') as f:\n    content = f.read()\n\n# Find USB device installation sections\npattern = r'>>>\\s+\\[Device Install.*?\\n.*?Section start (\\d{4}\u002F\\d{2}\u002F\\d{2} \\d{2}:\\d{2}:\\d{2}).*?\\n(.*?)\u003C\u003C\u003C'\nmatches = re.findall(pattern, content, re.DOTALL)\n\nusb_installs = []\nfor timestamp, section in matches:\n    if 'USBSTOR' in section or 'USB\\\\VID' in section:\n        # Extract device ID\n        dev_match = re.search(r'(USBSTOR\\\\[^\\s]+|USB\\\\VID_\\w+&PID_\\w+[^\\s]*)', section)\n        if dev_match:\n            device_id = dev_match.group(1)\n            usb_installs.append({\n                'first_install': timestamp,\n                'device_id': device_id\n            })\n            print(f\"  {timestamp} | {device_id}\")\n\nprint(f\"\\nTotal USB installations found: {len(usb_installs)}\")\nPYEOF\n\n# Parse Windows Event Logs for USB events\n# Event IDs: 2003, 2010, 2100, 2102 (DriverFrameworks-UserMode)\n# Event IDs: 6416 (Security - new external device recognized)\npython3 \u003C\u003C 'PYEOF'\nimport json\nfrom evtx import PyEvtxParser\n\ntry:\n    parser = PyEvtxParser(\"\u002Fcases\u002Fcase-2024-001\u002Fusb\u002FSystem.evtx\")\n\n    print(\"\\n=== SYSTEM EVENT LOG USB EVENTS ===\\n\")\n    for record in parser.records_json():\n        data = json.loads(record['data'])\n        event_id = str(data['Event']['System']['EventID'])\n\n        # USB device connection events\n        if event_id in ('20001', '20003', '10000', '10100'):\n            timestamp = data['Event']['System']['TimeCreated']['#attributes']['SystemTime']\n            event_data = data['Event'].get('UserData', data['Event'].get('EventData', {}))\n            print(f\"  [{timestamp}] EventID {event_id}: {json.dumps(event_data, default=str)[:200]}\")\nexcept Exception as e:\n    print(f\"Error: {e}\")\nPYEOF\n```\n\n### Step 5: Build USB Activity Timeline and Report\n\n```bash\n# Compile all USB evidence into a unified timeline\npython3 \u003C\u003C 'PYEOF'\nimport json, csv\n\ntimeline = []\n\n# Load USBSTOR data\nwith open('\u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fusb_devices.json') as f:\n    devices = json.load(f)\n\nfor device in devices:\n    timeline.append({\n        'timestamp': device['last_connected'],\n        'source': 'USBSTOR Registry',\n        'device': f\"{device['vendor']} {device['product']}\",\n        'serial': device['serial'],\n        'event': 'Last Connected',\n        'detail': device.get('friendly_name', '')\n    })\n\n# Sort chronologically\ntimeline.sort(key=lambda x: x['timestamp'])\n\n# Write timeline CSV\nwith open('\u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fusb_timeline.csv', 'w', newline='') as f:\n    writer = csv.DictWriter(f, fieldnames=['timestamp', 'source', 'device', 'serial', 'event', 'detail'])\n    writer.writeheader()\n    writer.writerows(timeline)\n\nprint(f\"USB Timeline: {len(timeline)} events written to usb_timeline.csv\")\n\n# Print summary\nprint(\"\\n=== USB DEVICE SUMMARY ===\")\nfor entry in timeline:\n    print(f\"  {entry['timestamp']} | {entry['device']} | {entry['serial'][:20]} | {entry['event']}\")\nPYEOF\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| USBSTOR | Registry key storing USB mass storage device identification and connection data |\n| VID\u002FPID | Vendor ID and Product ID uniquely identifying USB device manufacturer and model |\n| Device serial number | Unique identifier for individual USB devices (some devices share serials) |\n| MountedDevices | Registry key mapping volume GUIDs and drive letters to physical devices |\n| MountPoints2 | Per-user registry key showing which volumes a user accessed |\n| SetupAPI log | Windows driver installation log recording first-time device connections |\n| DeviceContainers | Registry key in SOFTWARE hive with device metadata and timestamps |\n| EMDMgmt | Registry key tracking ReadyBoost-compatible devices with serial numbers and timestamps |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| USB Forensic Tracker | Specialized tool for USB device history extraction |\n| USBDeview | NirSoft tool listing all USB devices connected to a system |\n| RegRipper (usbstor plugin) | Automated USB artifact extraction from registry hives |\n| Registry Explorer | Interactive registry analysis for USB-related keys |\n| KAPE | Automated collection of USB-related artifacts |\n| Plaso\u002Flog2timeline | Timeline creation including USB connection events |\n| FTK Imager | Forensic imaging including removable media |\n| Velociraptor | Endpoint agent with USB device history hunting artifacts |\n\n## Common Scenarios\n\n**Scenario 1: Data Exfiltration by Departing Employee**\nExtract USBSTOR entries to identify all USB devices ever connected, correlate device serial numbers with MountPoints2 to confirm user access, cross-reference timestamps with file access logs and jump list recent files, check for large file copy patterns in USN journal.\n\n**Scenario 2: Unauthorized Device on Secure System**\nAudit all USBSTOR entries against approved device list, identify unauthorized devices by VID\u002FPID not matching corporate-approved hardware, determine when the unauthorized device was first and last connected, check if any data was transferred.\n\n**Scenario 3: Malware Delivery via USB**\nIdentify USB device connected just before malware execution (Prefetch timestamps), extract the device serial and vendor information, check if autorun was enabled for the device, look for executable launch from the removable drive letter in Prefetch and ShimCache.\n\n**Scenario 4: Tracking a Specific USB Drive Across Multiple Systems**\nSearch for the same device serial number in USBSTOR across all forensic images, build a map of which systems the drive was connected to and when, identify the chronological path of the device through the organization, correlate with network share access logs.\n\n## Output Format\n\n```\nUSB Device History Analysis:\n  System: DESKTOP-ABC123 (Windows 10 Pro)\n  Total USB Storage Devices: 12\n  Analysis Sources: USBSTOR, MountedDevices, MountPoints2, SetupAPI, Event Logs\n\n  Device Inventory:\n    1. Kingston DataTraveler 3.0 (Serial: 0019E06B4521A2B0)\n       First Connected:  2024-01-10 09:15:32 (SetupAPI)\n       Last Connected:   2024-01-18 14:30:00 (USBSTOR)\n       Drive Letter:     E:\n       User Access:      suspect_user (MountPoints2)\n\n    2. WD My Passport (Serial: 575834314131363035)\n       First Connected:  2024-01-15 20:00:00\n       Last Connected:   2024-01-15 23:45:00\n       Drive Letter:     F:\n       User Access:      suspect_user\n\n  Suspicious Findings:\n    - Kingston drive connected 15 times during investigation period\n    - WD Passport connected only once, late evening (unusual hours)\n    - Unknown device (VID_1234&PID_5678) connected 2024-01-17, no matching approved device\n\n  Timeline: \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fusb_timeline.csv\n```\n","# Analyzing USB Device Connection History\n\n## When to Use\n- When investigating potential data exfiltration via removable storage devices\n- During insider threat investigations to track USB device usage\n- For compliance audits verifying removable media policy enforcement\n- When correlating USB connections with file access and copy events\n- For establishing a timeline of device connections during an incident\n\n## Prerequisites\n- Forensic image or extracted registry hives and event logs\n- Access to SYSTEM, SOFTWARE, and NTUSER.DAT registry hives\n- SetupAPI logs (setupapi.dev.log)\n- Windows Event Logs (System, Security, DriverFrameworks-UserMode)\n- USBDeview, USB Forensic Tracker, or RegRipper\n- Understanding of USB device identification (VID, PID, serial number)\n\n## Workflow\n\n### Step 1: Extract USB-Related Artifacts\n\n```bash\n# Mount forensic image and copy relevant artifacts\nmount -o ro,loop,offset=$((2048*512)) \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd \u002Fmnt\u002Fevidence\n\nmkdir -p \u002Fcases\u002Fcase-2024-001\u002Fusb\u002F\n\n# Registry hives\ncp \u002Fmnt\u002Fevidence\u002FWindows\u002FSystem32\u002Fconfig\u002FSYSTEM \u002Fcases\u002Fcase-2024-001\u002Fusb\u002F\ncp \u002Fmnt\u002Fevidence\u002FWindows\u002FSystem32\u002Fconfig\u002FSOFTWARE \u002Fcases\u002Fcase-2024-001\u002Fusb\u002F\ncp \u002Fmnt\u002Fevidence\u002FUsers\u002F*\u002FNTUSER.DAT \u002Fcases\u002Fcase-2024-001\u002Fusb\u002F\n\n# SetupAPI logs (first connection timestamps)\ncp \u002Fmnt\u002Fevidence\u002FWindows\u002FINF\u002Fsetupapi.dev.log \u002Fcases\u002Fcase-2024-001\u002Fusb\u002F\n\n# Event logs\ncp \u002Fmnt\u002Fevidence\u002FWindows\u002FSystem32\u002Fwinevt\u002FLogs\u002FSystem.evtx \u002Fcases\u002Fcase-2024-001\u002Fusb\u002F\ncp \"\u002Fmnt\u002Fevidence\u002FWindows\u002FSystem32\u002Fwinevt\u002FLogs\u002FMicrosoft-Windows-DriverFrameworks-UserMode%4Operational.evtx\" \\\n   \u002Fcases\u002Fcase-2024-001\u002Fusb\u002F 2>\u002Fdev\u002Fnull\ncp \"\u002Fmnt\u002Fevidence\u002FWindows\u002FSystem32\u002Fwinevt\u002FLogs\u002FMicrosoft-Windows-Partition%4Diagnostic.evtx\" \\\n   \u002Fcases\u002Fcase-2024-001\u002Fusb\u002F 2>\u002Fdev\u002Fnull\n```\n\n### Step 2: Parse USBSTOR Registry Key\n\n```bash\n# Extract USBSTOR entries from SYSTEM hive\npython3 \u003C\u003C 'PYEOF'\nfrom Registry import Registry\nimport json\n\nreg = Registry.Registry(\"\u002Fcases\u002Fcase-2024-001\u002Fusb\u002FSYSTEM\")\n\n# Find current ControlSet\nselect = reg.open(\"Select\")\ncurrent = select.value(\"Current\").value()\ncontrolset = f\"ControlSet{current:03d}\"\n\n# Parse USBSTOR\nusbstor_path = f\"{controlset}\\\\Enum\\\\USBSTOR\"\nusbstor = reg.open(usbstor_path)\n\ndevices = []\nprint(\"=== USBSTOR DEVICES ===\\n\")\n\nfor device_class in usbstor.subkeys():\n    # Format: Disk&Ven_VENDOR&Prod_PRODUCT&Rev_REVISION\n    class_name = device_class.name()\n    parts = class_name.split('&')\n    vendor = parts[1].replace('Ven_', '') if len(parts) > 1 else 'Unknown'\n    product = parts[2].replace('Prod_', '') if len(parts) > 2 else 'Unknown'\n    revision = parts[3].replace('Rev_', '') if len(parts) > 3 else 'Unknown'\n\n    for instance in device_class.subkeys():\n        serial = instance.name()\n        last_write = instance.timestamp()\n\n        device_info = {\n            'vendor': vendor,\n            'product': product,\n            'revision': revision,\n            'serial': serial,\n            'last_connected': str(last_write),\n        }\n\n        # Get friendly name if available\n        try:\n            friendly = instance.value(\"FriendlyName\").value()\n            device_info['friendly_name'] = friendly\n        except:\n            pass\n\n        # Get device parameters\n        try:\n            params = instance.subkey(\"Device Parameters\")\n            try:\n                device_info['class_guid'] = params.value(\"ClassGUID\").value()\n            except:\n                pass\n        except:\n            pass\n\n        devices.append(device_info)\n        print(f\"Device: {vendor} {product}\")\n        print(f\"  Serial: {serial}\")\n        print(f\"  Last Connected: {last_write}\")\n        print(f\"  Friendly Name: {device_info.get('friendly_name', 'N\u002FA')}\")\n        print()\n\n# Save results\nwith open('\u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fusb_devices.json', 'w') as f:\n    json.dump(devices, f, indent=2)\n\nprint(f\"\\nTotal USB storage devices found: {len(devices)}\")\nPYEOF\n```\n\n### Step 3: Extract Drive Letter Assignments and User Associations\n\n```bash\n# Parse MountedDevices from SYSTEM hive\npython3 \u003C\u003C 'PYEOF'\nfrom Registry import Registry\nimport struct\n\nreg = Registry.Registry(\"\u002Fcases\u002Fcase-2024-001\u002Fusb\u002FSYSTEM\")\n\nmounted = reg.open(\"MountedDevices\")\n\nprint(\"=== MOUNTED DEVICES (Drive Letter Assignments) ===\\n\")\nfor value in mounted.values():\n    name = value.name()\n    data = value.value()\n\n    if name.startswith(\"\\\\DosDevices\\\\\"):\n        drive_letter = name.replace(\"\\\\DosDevices\\\\\", \"\")\n        if len(data) > 24:\n            # USB device - contains device path string\n            try:\n                device_path = data.decode('utf-16-le').strip('\\x00')\n                if 'USBSTOR' in device_path or 'USB#' in device_path:\n                    print(f\"  {drive_letter} -> {device_path}\")\n            except:\n                pass\n        else:\n            # Fixed disk - contains disk signature + offset\n            disk_sig = struct.unpack('\u003CI', data[0:4])[0]\n            offset = struct.unpack('\u003CQ', data[4:12])[0]\n            print(f\"  {drive_letter} -> Disk Signature: 0x{disk_sig:08X}, Offset: {offset}\")\nPYEOF\n\n# Parse user MountPoints2 (which user accessed which devices)\npython3 \u003C\u003C 'PYEOF'\nfrom Registry import Registry\nimport os, glob\n\nprint(\"\\n=== USER MOUNT POINTS (MountPoints2) ===\\n\")\n\nfor ntuser in glob.glob(\"\u002Fcases\u002Fcase-2024-001\u002Fusb\u002FNTUSER*.DAT\"):\n    try:\n        reg = Registry.Registry(ntuser)\n        mp2 = reg.open(\"Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Explorer\\\\MountPoints2\")\n\n        print(f\"User hive: {os.path.basename(ntuser)}\")\n        for key in mp2.subkeys():\n            guid = key.name()\n            last_write = key.timestamp()\n            if '{' in guid:\n                print(f\"  Volume: {guid} | Last accessed: {last_write}\")\n        print()\n    except Exception as e:\n        print(f\"  Error parsing {ntuser}: {e}\")\nPYEOF\n```\n\n### Step 4: Extract First Connection Timestamps from SetupAPI\n\n```bash\n# Parse setupapi.dev.log for USB device first-install timestamps\npython3 \u003C\u003C 'PYEOF'\nimport re\n\nprint(\"=== SETUPAPI USB DEVICE INSTALLATIONS ===\\n\")\n\nwith open('\u002Fcases\u002Fcase-2024-001\u002Fusb\u002Fsetupapi.dev.log', 'r', errors='ignore') as f:\n    content = f.read()\n\n# Find USB device installation sections\npattern = r'>>>\\s+\\[Device Install.*?\\n.*?Section start (\\d{4}\u002F\\d{2}\u002F\\d{2} \\d{2}:\\d{2}:\\d{2}).*?\\n(.*?)\u003C\u003C\u003C'\nmatches = re.findall(pattern, content, re.DOTALL)\n\nusb_installs = []\nfor timestamp, section in matches:\n    if 'USBSTOR' in section or 'USB\\\\VID' in section:\n        # Extract device ID\n        dev_match = re.search(r'(USBSTOR\\\\[^\\s]+|USB\\\\VID_\\w+&PID_\\w+[^\\s]*)', section)\n        if dev_match:\n            device_id = dev_match.group(1)\n            usb_installs.append({\n                'first_install': timestamp,\n                'device_id': device_id\n            })\n            print(f\"  {timestamp} | {device_id}\")\n\nprint(f\"\\nTotal USB installations found: {len(usb_installs)}\")\nPYEOF\n\n# Parse Windows Event Logs for USB events\n# Event IDs: 2003, 2010, 2100, 2102 (DriverFrameworks-UserMode)\n# Event IDs: 6416 (Security - new external device recognized)\npython3 \u003C\u003C 'PYEOF'\nimport json\nfrom evtx import PyEvtxParser\n\ntry:\n    parser = PyEvtxParser(\"\u002Fcases\u002Fcase-2024-001\u002Fusb\u002FSystem.evtx\")\n\n    print(\"\\n=== SYSTEM EVENT LOG USB EVENTS ===\\n\")\n    for record in parser.records_json():\n        data = json.loads(record['data'])\n        event_id = str(data['Event']['System']['EventID'])\n\n        # USB device connection events\n        if event_id in ('20001', '20003', '10000', '10100'):\n            timestamp = data['Event']['System']['TimeCreated']['#attributes']['SystemTime']\n            event_data = data['Event'].get('UserData', data['Event'].get('EventData', {}))\n            print(f\"  [{timestamp}] EventID {event_id}: {json.dumps(event_data, default=str)[:200]}\")\nexcept Exception as e:\n    print(f\"Error: {e}\")\nPYEOF\n```\n\n### Step 5: Build USB Activity Timeline and Report\n\n```bash\n# Compile all USB evidence into a unified timeline\npython3 \u003C\u003C 'PYEOF'\nimport json, csv\n\ntimeline = []\n\n# Load USBSTOR data\nwith open('\u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fusb_devices.json') as f:\n    devices = json.load(f)\n\nfor device in devices:\n    timeline.append({\n        'timestamp': device['last_connected'],\n        'source': 'USBSTOR Registry',\n        'device': f\"{device['vendor']} {device['product']}\",\n        'serial': device['serial'],\n        'event': 'Last Connected',\n        'detail': device.get('friendly_name', '')\n    })\n\n# Sort chronologically\ntimeline.sort(key=lambda x: x['timestamp'])\n\n# Write timeline CSV\nwith open('\u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fusb_timeline.csv', 'w', newline='') as f:\n    writer = csv.DictWriter(f, fieldnames=['timestamp', 'source', 'device', 'serial', 'event', 'detail'])\n    writer.writeheader()\n    writer.writerows(timeline)\n\nprint(f\"USB Timeline: {len(timeline)} events written to usb_timeline.csv\")\n\n# Print summary\nprint(\"\\n=== USB DEVICE SUMMARY ===\")\nfor entry in timeline:\n    print(f\"  {entry['timestamp']} | {entry['device']} | {entry['serial'][:20]} | {entry['event']}\")\nPYEOF\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| USBSTOR | Registry key storing USB mass storage device identification and connection data |\n| VID\u002FPID | Vendor ID and Product ID uniquely identifying USB device manufacturer and model |\n| Device serial number | Unique identifier for individual USB devices (some devices share serials) |\n| MountedDevices | Registry key mapping volume GUIDs and drive letters to physical devices |\n| MountPoints2 | Per-user registry key showing which volumes a user accessed |\n| SetupAPI log | Windows driver installation log recording first-time device connections |\n| DeviceContainers | Registry key in SOFTWARE hive with device metadata and timestamps |\n| EMDMgmt | Registry key tracking ReadyBoost-compatible devices with serial numbers and timestamps |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| USB Forensic Tracker | Specialized tool for USB device history extraction |\n| USBDeview | NirSoft tool listing all USB devices connected to a system |\n| RegRipper (usbstor plugin) | Automated USB artifact extraction from registry hives |\n| Registry Explorer | Interactive registry analysis for USB-related keys |\n| KAPE | Automated collection of USB-related artifacts |\n| Plaso\u002Flog2timeline | Timeline creation including USB connection events |\n| FTK Imager | Forensic imaging including removable media |\n| Velociraptor | Endpoint agent with USB device history hunting artifacts |\n\n## Common Scenarios\n\n**Scenario 1: Data Exfiltration by Departing Employee**\nExtract USBSTOR entries to identify all USB devices ever connected, correlate device serial numbers with MountPoints2 to confirm user access, cross-reference timestamps with file access logs and jump list recent files, check for large file copy patterns in USN journal.\n\n**Scenario 2: Unauthorized Device on Secure System**\nAudit all USBSTOR entries against approved device list, identify unauthorized devices by VID\u002FPID not matching corporate-approved hardware, determine when the unauthorized device was first and last connected, check if any data was transferred.\n\n**Scenario 3: Malware Delivery via USB**\nIdentify USB device connected just before malware execution (Prefetch timestamps), extract the device serial and vendor information, check if autorun was enabled for the device, look for executable launch from the removable drive letter in Prefetch and ShimCache.\n\n**Scenario 4: Tracking a Specific USB Drive Across Multiple Systems**\nSearch for the same device serial number in USBSTOR across all forensic images, build a map of which systems the drive was connected to and when, identify the chronological path of the device through the organization, correlate with network share access logs.\n\n## Output Format\n\n```\nUSB Device History Analysis:\n  System: DESKTOP-ABC123 (Windows 10 Pro)\n  Total USB Storage Devices: 12\n  Analysis Sources: USBSTOR, MountedDevices, MountPoints2, SetupAPI, Event Logs\n\n  Device Inventory:\n    1. Kingston DataTraveler 3.0 (Serial: 0019E06B4521A2B0)\n       First Connected:  2024-01-10 09:15:32 (SetupAPI)\n       Last Connected:   2024-01-18 14:30:00 (USBSTOR)\n       Drive Letter:     E:\n       User Access:      suspect_user (MountPoints2)\n\n    2. WD My Passport (Serial: 575834314131363035)\n       First Connected:  2024-01-15 20:00:00\n       Last Connected:   2024-01-15 23:45:00\n       Drive Letter:     F:\n       User Access:      suspect_user\n\n  Suspicious Findings:\n    - Kingston drive connected 15 times during investigation period\n    - WD Passport connected only once, late evening (unusual hours)\n    - Unknown device (VID_1234&PID_5678) connected 2024-01-17, no matching approved device\n\n  Timeline: \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fusb_timeline.csv\n```\n",{"name":5,"tags":49,"author":50,"domain":35,"license":15,"version":51,"nist_csf":52,"subdomain":57,"description":7,"mitre_attack":58},[41,37,36,28,39,34],"mahipal","1.0",[53,54,55,56],"RS.AN-01","RS.AN-03","DE.AE-02","RS.MA-01","digital-forensics",[59,60,61,62,63],"T1052.001","T1025","T1091","T1005","T1074.001","main","7925716f065257435fdb12e97f7e52842147d5ad",".claude\u002Fskills\u002Fanalyzing-usb-device-connection-history","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude","https:\u002F\u002Fclaude.com\u002Fclaude-code","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho","Software · Applied AI · Quantitative Modeling · Building with Claude.","2026-06-10 12:24:46",{"source":8,"skillName":5,"commands":73,"prompt":83,"zipAvailable":84},[74,77,80],{"tool":75,"command":76},"npx","npx skills add henriquescastilho\u002Fmy-claude --skill analyzing-usb-device-connection-history",{"tool":78,"command":79},"bunx","bunx skills add henriquescastilho\u002Fmy-claude --skill analyzing-usb-device-connection-history",{"tool":81,"command":82},"pnpm","pnpm dlx skills add henriquescastilho\u002Fmy-claude --skill analyzing-usb-device-connection-history","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fanalyzing-usb-device-connection-history\u002FSKILL.md",true,[86,91,97,101],{"path":87,"resourceType":87,"resourceTypeDesc":88,"sizeBytes":89,"sourceHtmlUrl":90},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fanalyzing-usb-device-connection-history\u002FLICENSE",{"path":92,"resourceType":93,"resourceTypeDesc":94,"sizeBytes":95,"sourceHtmlUrl":96},"references\u002Fapi-reference.md","REFERENCE","参考文档",2194,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fanalyzing-usb-device-connection-history\u002Freferences\u002Fapi-reference.md",{"path":98,"resourceType":93,"resourceTypeDesc":94,"sizeBytes":99,"sourceHtmlUrl":100},"references\u002Fpath-containment-handle-checklist.md",18512,"https:\u002F\u002Fgithub.com\u002F0disoft\u002Fmustflow\u002Fblob\u002Fmain\u002Ftemplates\u002Fdefault\u002Flocales\u002Fen\u002F.mustflow\u002Fskills\u002Fcross-platform-filesystem-safety\u002Freferences\u002Fpath-containment-handle-checklist.md",{"path":102,"resourceType":103,"resourceTypeDesc":104,"sizeBytes":105,"sourceHtmlUrl":106},"scripts\u002Fagent.py","SCRIPT","脚本",6587,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fanalyzing-usb-device-connection-history\u002Fscripts\u002Fagent.py",[108,149,158,167,189,214],{"skillNo":109,"name":110,"nameZh":6,"description":111,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":112,"licenseFileUrl":6,"sourceHtmlUrl":113,"categories":114,"keywords":129,"publishedAt":44},"01M6F0B6XPQ65AX2X0DWK8KT3E","markitdown","Convert files and office documents to Markdown. Supports PDF, DOCX, PPTX, XLSX, images (with OCR), audio (with transcription), HTML, CSV, JSON, XML, ZIP, YouTube URLs, EPubs and more.","MIT","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[115,118,121,124],{"categoryNo":116,"categoryName":117,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000002","文档处理",{"categoryNo":119,"categoryName":120,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000003","演示文稿",{"categoryNo":122,"categoryName":123,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000004","电子表格",{"categoryNo":125,"categoryName":126,"taxonomyType":127,"taxonomyTypeDesc":128},"01JBSEEDCAT000000000000034","行政与办公人员","PROFESSION","适用职业",[110,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148],"docx","PDF","pptx","xlsx","documents","csv","ocr","Audio","Bash","markdown","convert","read","write","edit","html","images","files","youtube","with",{"skillNo":150,"name":110,"nameZh":6,"description":111,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":112,"licenseFileUrl":6,"sourceHtmlUrl":151,"categories":152,"keywords":157,"publishedAt":44},"01M6F06SBHR9F0SDWE282Y8075","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fscientific_writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[153,154,155,156],{"categoryNo":116,"categoryName":117,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":119,"categoryName":120,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":122,"categoryName":123,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":125,"categoryName":126,"taxonomyType":127,"taxonomyTypeDesc":128},[110,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148],{"skillNo":159,"name":110,"nameZh":6,"description":111,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":112,"licenseFileUrl":6,"sourceHtmlUrl":160,"categories":161,"keywords":166,"publishedAt":44},"01M6F02D4R14EJAPBWVDF9J9VQ","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[162,163,164,165],{"categoryNo":116,"categoryName":117,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":119,"categoryName":120,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":122,"categoryName":123,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":125,"categoryName":126,"taxonomyType":127,"taxonomyTypeDesc":128},[110,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148],{"skillNo":168,"name":169,"nameZh":6,"description":170,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":112,"licenseFileUrl":6,"sourceHtmlUrl":171,"categories":172,"keywords":173,"publishedAt":44},"01M6F000KS6YB4MKS774G4R8ND","zarr-python","Chunked N-D arrays for cloud storage. Compressed arrays, parallel I\u002FO, S3\u002FGCS integration, NumPy\u002FDask\u002FXarray compatible, for large-scale scientific computing pipelines.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fzarr-python\u002FSKILL.md",[],[174,175,176,177,178,179,180,181,182,183,184,185,186,187,188],"python","zarr python","storage","integration","s3","gcs","cloud","dask","parallel","pipelines","arrays","numpy","scientific computing","scale","scientific",{"skillNo":190,"name":191,"nameZh":6,"description":192,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":112,"licenseFileUrl":6,"sourceHtmlUrl":193,"categories":194,"keywords":196,"publishedAt":44},"01M6EZZJWFXM1GR78KTW6J0DN8","what-if-oracle","Run structured What-If scenario analysis with multi-branch possibility exploration. Use this skill when the user asks speculative questions like \"what if...\", \"what would happen if...\", \"what are the possibilities\", \"explore scenarios\", \"scenario analysis\", \"possibility space\", \"what could go wrong\", \"best case \u002F worst case\", \"risk analysis\", \"contingency planning\", \"strategic options\", or any question about uncertain futures. Also trigger when the user faces a fork-in-the-road decision, wants to stress-test an idea, or needs to think through consequences before committing.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fwhat-if-oracle\u002FSKILL.md",[195],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[197,198,199,200,201,202,33,203,204,205,206,141,142,207,208,209,210,211,212,213],"oracle","what if oracle","go","run","ux","futures","explore","decision","branch","question","idea","exploration","options","stress-test","strategies","scenario","stress",{"skillNo":215,"name":216,"nameZh":6,"description":217,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":112,"licenseFileUrl":6,"sourceHtmlUrl":218,"categories":219,"keywords":230,"publishedAt":44},"01M6EZZCXAEB49RXGQCJX5E8GB","venue-templates","Access comprehensive LaTeX templates, formatting requirements, and submission guidelines for major scientific publication venues (Nature, Science, PLOS, IEEE, ACM), academic conferences (NeurIPS, ICML, CVPR, CHI), research posters, and grant proposals (NSF, NIH, DOE, DARPA). This skill should be used when preparing manuscripts for journal submission, conference papers, research posters, or grant proposals and need venue-specific formatting requirements and templates.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fvenue-templates\u002FSKILL.md",[220,223,226,227],{"categoryNo":221,"categoryName":222,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":224,"categoryName":225,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000021","资料检索与研究",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":228,"categoryName":229,"taxonomyType":127,"taxonomyTypeDesc":128},"01JBSEEDCAT000000000000036","内容创作者",[231,232,233,234,235,236,237,238,138,239,141,142,143,240,241,242,243,244,188,245],"templates","venue templates","research","guidelines","NeurIPS","ICML","LaTeX","science","access","proposals","Academic","requirements","formatting","journal","chi"]