diff --git a/trunk/report_templates/SYSTEM_UsbStorageDevices2.qs b/trunk/report_templates/SYSTEM_UsbStorageDevices2.qs
new file mode 100644
index 0000000..0b11e6a
--- /dev/null
+++ b/trunk/report_templates/SYSTEM_UsbStorageDevices2.qs
@@ -0,0 +1,181 @@
+function fred_report_info() {
+ var info={report_cat : "SYSTEM",
+ report_name : "USB storage devices as table",
+ report_author : "Gillen Daniel, Voncken Guy",
+ report_desc : "Dump USB storage devices",
+ fred_api : 2,
+ hive : "SYSTEM"
+ };
+ return info;
+}
+
+function IsValid(val) {
+ if(typeof val !== 'undefined') return true;
+ else return false;
+}
+
+function print_table_row(cell01,cell02) {
+ println("
",cell01," | ",cell02," |
");
+}
+
+function print_dev_table_row(VendorProd,
+ ID,
+ Class,
+ Name,
+ MountPoint,
+ ParentId,
+ Desc)
+{
+ println(" ");
+ println(" ",VendorProd," | ");
+ println(" ",ID," | ");
+ println(" ",Class," | ");
+ println(" ",Name," | ");
+ println(" ",MountPoint," | ");
+ println(" ",ParentId," | ");
+ println(" ",Desc," | ");
+ println("
");
+}
+
+function ZeroPad(number,padlen) {
+ var ret=number.toString(10);
+ if(!padlen || ret.length>=padlen) return ret;
+ return Math.pow(10,padlen-ret.length).toString().slice(1)+ret;
+}
+
+function GetKeyVal(path, key) {
+ var val=GetRegistryKeyValue(path, key);
+ return (IsValid(val)) ? RegistryKeyValueToString(val.value,val.type) : "";
+}
+
+function fred_report_html() {
+ // TODO: There is more here.
+ // Check http://www.forensicswiki.org/wiki/USB_History_Viewing
+ var val;
+
+ println(" USB storage devices
");
+
+ // Preload MountedDevices to possibly identify mount points of USB storage
+ // devices
+ var mnt_keys=GetRegistryKeys("\\MountedDevices");
+ var mnt_values=new Array();
+ if(IsValid(mnt_keys)) {
+ for(var i=0;i");
+ println(" Settings
");
+ println(" ");
+
+ // Are USB storage devices enabled?
+ // http://www.forensicmag.com/article/windows-7-registry-forensics-part-5
+ // Is this true for WinXP etc.. ???
+ var val=GetRegistryKeyValue(cur_controlset+"\\services\\USBSTOR","Start");
+ if(IsValid(val)) {
+ val=RegistryKeyValueToString(val.value,val.type);
+ val=parseInt(String(val).substr(2,8),10);
+ switch(val) {
+ case 3:
+ print_table_row("Storage driver enabled:","Yes");
+ break;
+ case 4:
+ print_table_row("Storage driver enabled:","No");
+ break;
+ default:
+ print_table_row("Storage driver enabled:","Unknown");
+ }
+ } else {
+ print_table_row("Storage driver enabled:","Unknown");
+ }
+
+ println("
");
+ println(" ");
+ println(" ");
+ println(" Devices
");
+
+ var storage_roots=GetRegistryNodes(cur_controlset+"\\Enum\\USBSTOR");
+ if(IsValid(storage_roots)) {
+ println("
");
+ print_dev_table_row("Vendor Name",
+ "Unique ID",
+ "Class",
+ "Friendly name",
+ "Mount point(s)",
+ "Parent ID",
+ "Device description");
+ for(var i=0; i";
+ else br=1;
+ MountPoints = MountPoints + mnt_keys[iii];
+ }
+ }
+ if(br==0) MountPoints = MountPoints + "n/a";
+
+ print_dev_table_row(storage_roots[i],
+ ID,
+ Class,
+ FriendlyName,
+ MountPoints,
+ ParentID,
+ DeviceDesc);
+ }
+ }
+ println("
");
+ println("
");
+ } else {
+ println(" This registry hive does not contain a ",
+ "list of attached USB storage devices!");
+ }
+ println(" ");
+ } else {
+ println(" ");
+ println(" Unable to determine current control set!
");
+ println(" Are you sure you are running this report against the correct ",
+ "registry hive?");
+ println("
");
+ }
+}
+