No OneTemporary
Actions

Size

53 KB

Referenced Files

None

Subscribers

None

View Options

	diff --git a/trunk/debian/fred-reports.install b/trunk/debian/fred-reports.install
	index d406d30..42ea7c5 100644
	--- a/trunk/debian/fred-reports.install
	+++ b/trunk/debian/fred-reports.install
	@@ -1,7 +1,17 @@
	+report_templates/NTUSER_Autoruns.qs usr/share/fred/report_templates/
	+report_templates/NTUSER_LaunchedApplications.qs usr/share/fred/report_templates/
	report_templates/NTUSER_RecentDocs.qs usr/share/fred/report_templates/
	report_templates/NTUSER_TypedUrls.qs usr/share/fred/report_templates/
	+report_templates/NTUSER_Windows7_SearchKeywords.qs usr/share/fred/report_templates/
	+report_templates/NTUSER_Windows7_TypedPaths.qs usr/share/fred/report_templates/
	+report_templates/NTUSER_WindowsLiveAccounts.qs usr/share/fred/report_templates/
	report_templates/SAM_UserAccounts.qs usr/share/fred/report_templates/
	+report_templates/SOFTWARE_Autoruns.qs usr/share/fred/report_templates/
	+report_templates/SOFTWARE_ProfileList.qs usr/share/fred/report_templates/
	report_templates/SOFTWARE_WindowsVersion.qs usr/share/fred/report_templates/
	+report_templates/SYSTEM_BackupRestore.qs usr/share/fred/report_templates/
	report_templates/SYSTEM_CurrentNetworkSettings.qs usr/share/fred/report_templates/
	+report_templates/SYSTEM_Services.qs usr/share/fred/report_templates/
	+report_templates/SYSTEM_ShutdownTime.qs usr/share/fred/report_templates/
	report_templates/SYSTEM_SystemTimeInfo.qs usr/share/fred/report_templates/
	report_templates/SYSTEM_UsbStorageDevices.qs usr/share/fred/report_templates/
	diff --git a/trunk/report_templates/SAM_UserAccounts.qs b/trunk/report_templates/SAM_UserAccounts.qs
	index a94c21b..677cf37 100644
	--- a/trunk/report_templates/SAM_UserAccounts.qs
	+++ b/trunk/report_templates/SAM_UserAccounts.qs
	@@ -1,104 +1,144 @@
	function fred_report_info() {
	var info={report_cat : "SAM",
	report_name : "User accounts",
	- report_author : "Gillen Daniel",
	+ report_author : "Gillen Daniel, Voncken Guy",
	report_desc : "Dump Windows user accounts",
	fred_api : 2,
	hive : "SAM"
	};
	return info;
	}

	+var table_style = "border-collapse:collapse; margin-left:20px; font-family:arial; font-size:12;";
	+var cell_style = "border:1px solid #888888; padding:5; white-space:nowrap;";
	+
	function IsValid(val) {
	- if(typeof val !== 'undefined') return true;
	- else return false;
	+ return (typeof val!=='undefined');
	+}
	+
	+function PrintTableHeaderCell(str) {
	+ println(" <th style=\"",cell_style,"\">",str,"</th>");
	}

	-function print_table_row(cell01,cell02) {
	- println(" <tr><td>",cell01,"</td><td>",cell02,"</td></tr>");
	+function PrintTableDataCell(alignment,str) {
	+ var style=cell_style+" text-align:"+alignment+";";
	+ println(" <td style=\"",style,"\">",str,"</td>");
	}

	-function print_v_info(v_key_value,info_name,str_off) {
	+
	+function Get_v_info(v_key_value,str_off) {
	+ var ret_str="";
	var offset=Number(RegistryKeyValueToVariant(v_key_value,"uint16",str_off))+0x0cc;
	var len=Number(RegistryKeyValueToVariant(v_key_value,"uint16",str_off+4));
	- if(len>0) print_table_row(info_name,RegistryKeyValueToVariant(v_key_value,"utf16",offset,len));
	+ if(len>0) ret_str=RegistryKeyValueToVariant(v_key_value,"utf16",offset,len)
	+
	+ return ret_str;
	}

	function fred_report_html() {
	// See http://windowsir.blogspot.com/2006/08/getting-user-info-from-image.html
	println(" <h2>User accounts</h2>");

	// Iterate over all user names
	var user_names=GetRegistryNodes("\\SAM\\Domains\\Account\\Users\\Names");
	if(IsValid(user_names)) {
	- for(var i=0;i<user_names.length;i++) {
	- println(" <p style=\"font-size:12; white-space:nowrap\">");
	+ println(" <table style=\""+table_style+"\">");

	- // Print user name
	- println(" <u>",user_names[i],"</u><br />");
	-
	- println(" <table style=\"margin-left:20px; font-size:12\">");
	+ println(" <tr>");
	+ PrintTableHeaderCell("Name");
	+ PrintTableHeaderCell("RID");
	+ PrintTableHeaderCell("Full<br>name");
	+ PrintTableHeaderCell("Last<br>login");
	+ PrintTableHeaderCell("Last PW<br>change");
	+ PrintTableHeaderCell("Last failed<br>login");
	+ PrintTableHeaderCell("Account<br>expiry");
	+ PrintTableHeaderCell("Total<br>logins");
	+ PrintTableHeaderCell("Failed<br>logins");
	+ PrintTableHeaderCell("Flags");
	+ PrintTableHeaderCell("Password<br>hint");
	+ PrintTableHeaderCell("Home drive<br>and dir");
	+ PrintTableHeaderCell("Logon<br>script path");
	+ PrintTableHeaderCell("Profile<br>path");
	+ PrintTableHeaderCell("Comment");
	+ println(" </tr>");

	+ for(var i=0;i<user_names.length;i++) {
	// Get user rid stored in "default" key
	- var user_rid=GetRegistryKeyValue(String().concat("\\SAM\\Domains\\Account\\Users\\Names\\",user_names[i]),"");
	+ var user_rid=GetRegistryKeyValue(String().concat("\\SAM\\Domains\\Account\\Users\\Names\\",user_names[i]),"");
	user_rid=RegistryKeyTypeToString(user_rid.type);
	- println(" <tr><td>RID:</td><td>",Number(user_rid).toString(10)," (",user_rid,")","</td></tr>");
	-
	- // RegistryKeyTypeToString returns the rid prepended with "0x". We have to remove that for further processing
	- user_rid=String(user_rid).substr(2);
	+ user_rid_dec=Number(user_rid).toString(10);

	// Get user's V key and print various infos
	+ user_rid=String(user_rid).substr(2); // Remove "0x"
	var v_key=GetRegistryKeyValue(String().concat("\\SAM\\Domains\\Account\\Users\\",user_rid),"V");
	- print_v_info(v_key.value,"Full name:",0x18);
	- print_v_info(v_key.value,"Comment:",0x24);
	- print_v_info(v_key.value,"Home directory:",0x48);
	- print_v_info(v_key.value,"Home directory drive:",0x54);
	- print_v_info(v_key.value,"Logon script path:",0x60);
	- print_v_info(v_key.value,"Profile path:",0x6c);
	+ var full_name=Get_v_info(v_key.value,0x18);
	+ var comment=Get_v_info(v_key.value,0x24);
	+ var home_dir=Get_v_info(v_key.value,0x48);
	+ var home_dir_drive=Get_v_info(v_key.value,0x54);
	+ var logon_script_path=Get_v_info(v_key.value,0x60);
	+ var profile_path=Get_v_info(v_key.value,0x6c);

	// Get user's F key and print various infos
	var f_key=GetRegistryKeyValue(String().concat("\\SAM\\Domains\\Account\\Users\\",user_rid),"F");
	- print_table_row("Last login time:",RegistryKeyValueToVariant(f_key.value,"filetime",8));
	- print_table_row("Last pw change:",RegistryKeyValueToVariant(f_key.value,"filetime",24));
	- print_table_row("Last failed login:",RegistryKeyValueToVariant(f_key.value,"filetime",40));
	- print_table_row("Account expires:",RegistryKeyValueToVariant(f_key.value,"filetime",32));
	- print_table_row("Total logins:",RegistryKeyValueToVariant(f_key.value,"uint16",66));
	- print_table_row("Failed logins:",RegistryKeyValueToVariant(f_key.value,"uint16",64));
	+ var last_login_time=RegistryKeyValueToVariant(f_key.value,"filetime",8);
	+ var last_pw_change=RegistryKeyValueToVariant(f_key.value,"filetime",24);
	+ var last_failed_login=RegistryKeyValueToVariant(f_key.value,"filetime",40);
	+ var account_expires=RegistryKeyValueToVariant(f_key.value,"filetime",32);
	+ var total_logins=RegistryKeyValueToVariant(f_key.value,"uint16",66);
	+ var failed_logins=RegistryKeyValueToVariant(f_key.value,"uint16",64);
	+
	var acc_flags=Number(RegistryKeyValueToVariant(f_key.value,"uint16",56));
	- print(" <tr><td>Account flags:</td><td>");
	- if(acc_flags&0x0001) print("Disabled ");
	- if(acc_flags&0x0002) print("HomeDirReq ");
	- if(acc_flags&0x0004) print("PwNotReq ");
	- if(acc_flags&0x0008) print("TempDupAcc ");
	- // I don't think this would be useful to show
	- //if(acc_flags&0x0010) print("NormUserAcc ");
	- if(acc_flags&0x0020) print("MnsAcc ");
	- if(acc_flags&0x0040) print("DomTrustAcc ");
	- if(acc_flags&0x0080) print("WksTrustAcc ");
	- if(acc_flags&0x0100) print("SrvTrustAcc ");
	- if(acc_flags&0x0200) print("NoPwExpiry ");
	- if(acc_flags&0x0400) print("AccAutoLock ");
	- print(" (",acc_flags,")");
	- println("</td></tr>");
	+ var acc_flags_str="";
	+ if(acc_flags&0x0200) acc_flags_str+="NoPwExpiry ";
	+ if(acc_flags&0x0001) acc_flags_str+="Disabled ";
	+ if(acc_flags&0x0004) acc_flags_str+="PwNotReq ";
	+ if(acc_flags&0x0002) acc_flags_str+="HomeDirReq ";
	+ if(acc_flags&0x0008) acc_flags_str+="TempDupAcc ";
	+// if(acc_flags&0x0010) acc_flags_str+="NormUserAcc "; // I don't think this would be useful to show
	+ if(acc_flags&0x0020) acc_flags_str+="MnsAcc ";
	+ if(acc_flags&0x0040) acc_flags_str+="DomTrustAcc ";
	+ if(acc_flags&0x0080) acc_flags_str+="WksTrustAcc ";
	+ if(acc_flags&0x0100) acc_flags_str+="SrvTrustAcc ";
	+ if(acc_flags&0x0400) acc_flags_str+="AccAutoLock ";

	// Get password hint if available
	var hint=GetRegistryKeyValue(String().concat("\\SAM\\Domains\\Account\\Users\\",user_rid),"UserPasswordHint");
	- if(typeof hint !== 'undefined') {
	+ if(IsValid(hint)) {
	// Append missing trailing utf16 zero byte
	hint.value.appendByte(0);
	hint.value.appendByte(0);
	- print_table_row("Password hint:",RegistryKeyValueToVariant(hint.value,"utf16"));
	+ hint=RegistryKeyValueToVariant(hint.value,"utf16");
	+ } else {
	+ hint="";
	}

	// TODO: User group membership

	- println(" </table>");
	- println(" </p>");
	+ println (" <tr>");
	+ PrintTableDataCell("left",user_names[i]);
	+ PrintTableDataCell("right",String(user_rid_dec)+" (0x"+user_rid+")");
	+ PrintTableDataCell("left",full_name);
	+ PrintTableDataCell("right",last_login_time);
	+ PrintTableDataCell("right",last_pw_change);
	+ PrintTableDataCell("right",last_failed_login);
	+ PrintTableDataCell("left",account_expires);
	+ PrintTableDataCell("right",total_logins);
	+ PrintTableDataCell("right",failed_logins);
	+ PrintTableDataCell("left",acc_flags_str);
	+ PrintTableDataCell("left",hint);
	+ PrintTableDataCell("left",home_dir_drive+" "+home_dir);
	+ PrintTableDataCell("left",logon_script_path);
	+ PrintTableDataCell("left",profile_path);
	+ PrintTableDataCell("left",comment);
	+
	+ println (" </tr>")
	}
	+ println(" </table>");
	+ println("</p>");
	} else {
	- println(" <p><font color='red'>");
	- println(" Unable to enumerate users!<br />");
	- println(" Are you sure you are running this report against the correct registry hive?");
	- println(" </font></p>");
	+ println("<p><font color='red'>");
	+ println(" Unable to enumerate users!<br />");
	+ println(" Are you sure you are running this report against the correct registry hive?");
	+ println("</font></p>");
	}
	}
	diff --git a/trunk/report_templates/SAM_UserAccounts2.qs b/trunk/report_templates/SAM_UserAccounts2.qs
	deleted file mode 100644
	index e06da1e..0000000
	--- a/trunk/report_templates/SAM_UserAccounts2.qs
	+++ /dev/null
	@@ -1,144 +0,0 @@
	-function fred_report_info() {
	- var info={report_cat : "SAM",
	- report_name : "User accounts as table",
	- report_author : "Gillen Daniel, Voncken Guy",
	- report_desc : "Dump Windows user accounts",
	- fred_api : 2,
	- hive : "SAM"
	- };
	- return info;
	-}
	-
	-var table_style = "border-collapse:collapse; margin-left:20px; font-family:arial; font-size:12;";
	-var cell_style = "border:1px solid #888888; padding:5; white-space:nowrap;";
	-
	-function IsValid(val) {
	- return (typeof val!=='undefined');
	-}
	-
	-function PrintTableHeaderCell(str) {
	- println(" <th style=\"",cell_style,"\">",str,"</th>");
	-}
	-
	-function PrintTableDataCell(alignment,str) {
	- var style=cell_style+" text-align:"+alignment+";";
	- println(" <td style=\"",style,"\">",str,"</td>");
	-}
	-
	-
	-function Get_v_info(v_key_value,str_off) {
	- var ret_str="";
	- var offset=Number(RegistryKeyValueToVariant(v_key_value,"uint16",str_off))+0x0cc;
	- var len=Number(RegistryKeyValueToVariant(v_key_value,"uint16",str_off+4));
	- if(len>0) ret_str=RegistryKeyValueToVariant(v_key_value,"utf16",offset,len)
	-
	- return ret_str;
	-}
	-
	-function fred_report_html() {
	- // See http://windowsir.blogspot.com/2006/08/getting-user-info-from-image.html
	- println(" <h2>User accounts</h2>");
	-
	- // Iterate over all user names
	- var user_names=GetRegistryNodes("\\SAM\\Domains\\Account\\Users\\Names");
	- if(IsValid(user_names)) {
	- println(" <table style=\""+table_style+"\">");
	-
	- println(" <tr>");
	- PrintTableHeaderCell("Name");
	- PrintTableHeaderCell("RID");
	- PrintTableHeaderCell("Full<br>name");
	- PrintTableHeaderCell("Last<br>login");
	- PrintTableHeaderCell("Last PW<br>change");
	- PrintTableHeaderCell("Last failed<br>login");
	- PrintTableHeaderCell("Account<br>expiry");
	- PrintTableHeaderCell("Total<br>logins");
	- PrintTableHeaderCell("Failed<br>logins");
	- PrintTableHeaderCell("Flags");
	- PrintTableHeaderCell("Password<br>hint");
	- PrintTableHeaderCell("Home drive<br>and dir");
	- PrintTableHeaderCell("Logon<br>script path");
	- PrintTableHeaderCell("Profile<br>path");
	- PrintTableHeaderCell("Comment");
	- println(" </tr>");
	-
	- for(var i=0;i<user_names.length;i++) {
	- // Get user rid stored in "default" key
	- var user_rid=GetRegistryKeyValue(String().concat("\\SAM\\Domains\\Account\\Users\\Names\\",user_names[i]),"");
	- user_rid=RegistryKeyTypeToString(user_rid.type);
	- user_rid_dec=Number(user_rid).toString(10);
	-
	- // Get user's V key and print various infos
	- user_rid=String(user_rid).substr(2); // Remove "0x"
	- var v_key=GetRegistryKeyValue(String().concat("\\SAM\\Domains\\Account\\Users\\",user_rid),"V");
	- var full_name=Get_v_info(v_key.value,0x18);
	- var comment=Get_v_info(v_key.value,0x24);
	- var home_dir=Get_v_info(v_key.value,0x48);
	- var home_dir_drive=Get_v_info(v_key.value,0x54);
	- var logon_script_path=Get_v_info(v_key.value,0x60);
	- var profile_path=Get_v_info(v_key.value,0x6c);
	-
	- // Get user's F key and print various infos
	- var f_key=GetRegistryKeyValue(String().concat("\\SAM\\Domains\\Account\\Users\\",user_rid),"F");
	- var last_login_time=RegistryKeyValueToVariant(f_key.value,"filetime",8);
	- var last_pw_change=RegistryKeyValueToVariant(f_key.value,"filetime",24);
	- var last_failed_login=RegistryKeyValueToVariant(f_key.value,"filetime",40);
	- var account_expires=RegistryKeyValueToVariant(f_key.value,"filetime",32);
	- var total_logins=RegistryKeyValueToVariant(f_key.value,"uint16",66);
	- var failed_logins=RegistryKeyValueToVariant(f_key.value,"uint16",64);
	-
	- var acc_flags=Number(RegistryKeyValueToVariant(f_key.value,"uint16",56));
	- var acc_flags_str="";
	- if(acc_flags&0x0200) acc_flags_str+="NoPwExpiry ";
	- if(acc_flags&0x0001) acc_flags_str+="Disabled ";
	- if(acc_flags&0x0004) acc_flags_str+="PwNotReq ";
	- if(acc_flags&0x0002) acc_flags_str+="HomeDirReq ";
	- if(acc_flags&0x0008) acc_flags_str+="TempDupAcc ";
	-// if(acc_flags&0x0010) acc_flags_str+="NormUserAcc "; // I don't think this would be useful to show
	- if(acc_flags&0x0020) acc_flags_str+="MnsAcc ";
	- if(acc_flags&0x0040) acc_flags_str+="DomTrustAcc ";
	- if(acc_flags&0x0080) acc_flags_str+="WksTrustAcc ";
	- if(acc_flags&0x0100) acc_flags_str+="SrvTrustAcc ";
	- if(acc_flags&0x0400) acc_flags_str+="AccAutoLock ";
	-
	- // Get password hint if available
	- var hint=GetRegistryKeyValue(String().concat("\\SAM\\Domains\\Account\\Users\\",user_rid),"UserPasswordHint");
	- if(IsValid(hint)) {
	- // Append missing trailing utf16 zero byte
	- hint.value.appendByte(0);
	- hint.value.appendByte(0);
	- hint=RegistryKeyValueToVariant(hint.value,"utf16");
	- } else {
	- hint="";
	- }
	-
	- // TODO: User group membership
	-
	- println (" <tr>");
	- PrintTableDataCell("left",user_names[i]);
	- PrintTableDataCell("right",String(user_rid_dec)+" (0x"+user_rid+")");
	- PrintTableDataCell("left",full_name);
	- PrintTableDataCell("right",last_login_time);
	- PrintTableDataCell("right",last_pw_change);
	- PrintTableDataCell("right",last_failed_login);
	- PrintTableDataCell("left",account_expires);
	- PrintTableDataCell("right",total_logins);
	- PrintTableDataCell("right",failed_logins);
	- PrintTableDataCell("left",acc_flags_str);
	- PrintTableDataCell("left",hint);
	- PrintTableDataCell("left",home_dir_drive+" "+home_dir);
	- PrintTableDataCell("left",logon_script_path);
	- PrintTableDataCell("left",profile_path);
	- PrintTableDataCell("left",comment);
	-
	- println (" </tr>")
	- }
	- println(" </table>");
	- println("</p>");
	- } else {
	- println("<p><font color='red'>");
	- println(" Unable to enumerate users!<br />");
	- println(" Are you sure you are running this report against the correct registry hive?");
	- println("</font></p>");
	- }
	-}
	diff --git a/trunk/report_templates/SAM_UserAccounts.qs b/trunk/report_templates/SAM_UserAccounts_old.qs
	similarity index 98%
	copy from trunk/report_templates/SAM_UserAccounts.qs
	copy to trunk/report_templates/SAM_UserAccounts_old.qs
	index a94c21b..c9be641 100644
	--- a/trunk/report_templates/SAM_UserAccounts.qs
	+++ b/trunk/report_templates/SAM_UserAccounts_old.qs
	@@ -1,104 +1,104 @@
	function fred_report_info() {
	var info={report_cat : "SAM",
	- report_name : "User accounts",
	+ report_name : "OLD - User accounts",
	report_author : "Gillen Daniel",
	report_desc : "Dump Windows user accounts",
	fred_api : 2,
	hive : "SAM"
	};
	return info;
	}

	function IsValid(val) {
	if(typeof val !== 'undefined') return true;
	else return false;
	}

	function print_table_row(cell01,cell02) {
	println(" <tr><td>",cell01,"</td><td>",cell02,"</td></tr>");
	}

	function print_v_info(v_key_value,info_name,str_off) {
	var offset=Number(RegistryKeyValueToVariant(v_key_value,"uint16",str_off))+0x0cc;
	var len=Number(RegistryKeyValueToVariant(v_key_value,"uint16",str_off+4));
	if(len>0) print_table_row(info_name,RegistryKeyValueToVariant(v_key_value,"utf16",offset,len));
	}

	function fred_report_html() {
	// See http://windowsir.blogspot.com/2006/08/getting-user-info-from-image.html
	println(" <h2>User accounts</h2>");

	// Iterate over all user names
	var user_names=GetRegistryNodes("\\SAM\\Domains\\Account\\Users\\Names");
	if(IsValid(user_names)) {
	for(var i=0;i<user_names.length;i++) {
	println(" <p style=\"font-size:12; white-space:nowrap\">");

	// Print user name
	println(" <u>",user_names[i],"</u><br />");

	println(" <table style=\"margin-left:20px; font-size:12\">");

	// Get user rid stored in "default" key
	var user_rid=GetRegistryKeyValue(String().concat("\\SAM\\Domains\\Account\\Users\\Names\\",user_names[i]),"");
	user_rid=RegistryKeyTypeToString(user_rid.type);
	println(" <tr><td>RID:</td><td>",Number(user_rid).toString(10)," (",user_rid,")","</td></tr>");

	// RegistryKeyTypeToString returns the rid prepended with "0x". We have to remove that for further processing
	user_rid=String(user_rid).substr(2);

	// Get user's V key and print various infos
	var v_key=GetRegistryKeyValue(String().concat("\\SAM\\Domains\\Account\\Users\\",user_rid),"V");
	print_v_info(v_key.value,"Full name:",0x18);
	print_v_info(v_key.value,"Comment:",0x24);
	print_v_info(v_key.value,"Home directory:",0x48);
	print_v_info(v_key.value,"Home directory drive:",0x54);
	print_v_info(v_key.value,"Logon script path:",0x60);
	print_v_info(v_key.value,"Profile path:",0x6c);

	// Get user's F key and print various infos
	var f_key=GetRegistryKeyValue(String().concat("\\SAM\\Domains\\Account\\Users\\",user_rid),"F");
	print_table_row("Last login time:",RegistryKeyValueToVariant(f_key.value,"filetime",8));
	print_table_row("Last pw change:",RegistryKeyValueToVariant(f_key.value,"filetime",24));
	print_table_row("Last failed login:",RegistryKeyValueToVariant(f_key.value,"filetime",40));
	print_table_row("Account expires:",RegistryKeyValueToVariant(f_key.value,"filetime",32));
	print_table_row("Total logins:",RegistryKeyValueToVariant(f_key.value,"uint16",66));
	print_table_row("Failed logins:",RegistryKeyValueToVariant(f_key.value,"uint16",64));
	var acc_flags=Number(RegistryKeyValueToVariant(f_key.value,"uint16",56));
	print(" <tr><td>Account flags:</td><td>");
	if(acc_flags&0x0001) print("Disabled ");
	if(acc_flags&0x0002) print("HomeDirReq ");
	if(acc_flags&0x0004) print("PwNotReq ");
	if(acc_flags&0x0008) print("TempDupAcc ");
	// I don't think this would be useful to show
	//if(acc_flags&0x0010) print("NormUserAcc ");
	if(acc_flags&0x0020) print("MnsAcc ");
	if(acc_flags&0x0040) print("DomTrustAcc ");
	if(acc_flags&0x0080) print("WksTrustAcc ");
	if(acc_flags&0x0100) print("SrvTrustAcc ");
	if(acc_flags&0x0200) print("NoPwExpiry ");
	if(acc_flags&0x0400) print("AccAutoLock ");
	print(" (",acc_flags,")");
	println("</td></tr>");

	// Get password hint if available
	var hint=GetRegistryKeyValue(String().concat("\\SAM\\Domains\\Account\\Users\\",user_rid),"UserPasswordHint");
	if(typeof hint !== 'undefined') {
	// Append missing trailing utf16 zero byte
	hint.value.appendByte(0);
	hint.value.appendByte(0);
	print_table_row("Password hint:",RegistryKeyValueToVariant(hint.value,"utf16"));
	}

	// TODO: User group membership

	println(" </table>");
	println(" </p>");
	}
	} else {
	println(" <p><font color='red'>");
	println(" Unable to enumerate users!<br />");
	println(" Are you sure you are running this report against the correct registry hive?");
	println(" </font></p>");
	}
	}
	diff --git a/trunk/report_templates/SYSTEM_SystemTimeInfo.qs b/trunk/report_templates/SYSTEM_SystemTimeInfo.qs
	index b9880ec..9f7c3cb 100644
	--- a/trunk/report_templates/SYSTEM_SystemTimeInfo.qs
	+++ b/trunk/report_templates/SYSTEM_SystemTimeInfo.qs
	@@ -1,141 +1,141 @@
	function fred_report_info() {
	var info={report_cat : "SYSTEM",
	report_name : "System time info",
	report_author : "Gillen Daniel",
	report_desc : "Dump system time info",
	fred_api : 2,
	hive : "SYSTEM"
	};
	return info;
	}

	var table_style = "border-collapse:collapse; margin-left:20px; font-family:arial; font-size:12";
	var cell_style = "border:1px solid #888888; padding:5; white-space:nowrap;";

	function IsValid(val) {
	return (typeof val!=='undefined');
	}

	function PrintTableHeaderCell(str) {
	println(" <th style=\"",cell_style,"\">",str,"</th>");
	}

	function PrintTableDataCell(alignment,str) {
	var style=cell_style+" text-align:"+alignment+";";
	println(" <td style=\"",style,"\">",str,"</td>");
	}

	function ToUTC(num) {
	var retnum=new Number(num);
	if(retnum&0x80000000) {
	retnum=((0xFFFFFFFF-retnum)+1)/60;
	return "UTC+"+Number(retnum).toString(10);
	} else {
	retnum=retnum/60;
	if(retnum!=0) return "UTC-"+Number(retnum).toString(10);
	else return "UTC+"+Number(retnum).toString(10);
	}
	}

	function ZeroPad(number,padlen) {
	var ret=number.toString(10);
	if(!padlen \|\| ret.length>=padlen) return ret;
	return Math.pow(10,padlen-ret.length).toString().slice(1)+ret;
	}

	function fred_report_html() {
	var val;

	println(" <h2>System time info</h2>");

	// Get current controlset
	var cur_controlset=GetRegistryKeyValue("\\Select","Current");
	if(IsValid(cur_controlset)) {
	cur_controlset=RegistryKeyValueToString(cur_controlset.value,cur_controlset.type);
	// Current holds a DWORD value, thus we get a string like 0x00000000, but
	// control sets are referenced by its decimal representation.
	cur_controlset="ControlSet"+ZeroPad(parseInt(String(cur_controlset).substr(2,8),16),3)

	// Get W32Time service settings
	var w32time_startup_method="n/a";
	var w32time_time_servers="n/a";
	val=GetRegistryKeyValue(cur_controlset+"\\Services\\W32Time","Start");
	if(IsValid(val)) {
	val=RegistryKeyValueToString(val.value,val.type);
	switch(Number(val)) {
	case 0:
	w32time_startup_method="Boot";
	break;
	case 1:
	w32time_startup_method="System";
	break;
	case 2:
	w32time_startup_method="Automatic";
	break;
	case 3:
	w32time_startup_method="Manual";
	break;
	case 4:
	w32time_startup_method="Disabled";
	break;
	default:
	w32time_startup_method="Unknown";
	}
	// If service is enabled, get ntp server
	if(Number(val)<4) {
	val=GetRegistryKeyValue(cur_controlset+"\\Services\\W32Time\\Parameters","NtpServer");
	if(IsValid(val)) w32time_time_servers=RegistryKeyValueToString(val.value,val.type);
	}
	}

	println(" <p style=\"font-size:12; white-space:nowrap\">");
	println(" <table style=\""+table_style+"\">");
	println(" <tr><td>Active control set:</td><td>",cur_controlset,"</td></tr>");
	println(" <tr><td>W32Time startup method:</td><td>",w32time_startup_method,"</td></tr>");
	println(" <tr><td>W32Time NTP servers:</td><td>",w32time_time_servers,"</td></tr>");
	println(" </table>");
	println(" <br />");
	println(" <table style=\""+table_style+"\">");
	println(" <tr>");
	- PrintTableHeaderCell("XXX");
	+ PrintTableHeaderCell("Setting name");
	PrintTableHeaderCell("Time zone");
	println(" </tr>");

	// Active time bias
	val=GetRegistryKeyValue(cur_controlset+"\\Control\\TimeZoneInformation","ActiveTimeBias");
	var active_bias=(IsValid(val)) ? ToUTC(RegistryKeyValueToString(val.value,val.type)) : "n/a"

	// Std. tz name and bias
	val=GetRegistryKeyValue(cur_controlset+"\\Control\\TimeZoneInformation","StandardName");
	var std_name=(IsValid(val)) ? RegistryKeyValueToString(val.value,val.type) : "n/a";
	val=GetRegistryKeyValue(cur_controlset+"\\Control\\TimeZoneInformation","StandardBias");
	var std_bias=(IsValid(val)) ? ToUTC(RegistryKeyValueToString(val.value,val.type)) : "n/a";

	// Daylight tz name and bias
	val=GetRegistryKeyValue(cur_controlset+"\\Control\\TimeZoneInformation","DaylightName");
	var daylight_name=(IsValid(val)) ? RegistryKeyValueToString(val.value,val.type) : "n/a";
	val=GetRegistryKeyValue(cur_controlset+"\\Control\\TimeZoneInformation","DaylightBias");
	var daylight_bias=(IsValid(val)) ? ToUTC(RegistryKeyValueToString(val.value,val.type)) : "n/a";

	println(" <tr>");
	PrintTableDataCell("left","Active");
	PrintTableDataCell("left",active_bias);
	println(" </tr>");
	println(" <tr>");
	PrintTableDataCell("left","Standard");
	PrintTableDataCell("left",std_bias+" ("+std_name+")");
	println(" </tr>");
	println(" <tr>");
	PrintTableDataCell("left","Daylight");
	PrintTableDataCell("left",daylight_bias+" ("+daylight_name+")");
	println(" </tr>");

	println(" </table>");
	println(" </p>");
	} else {
	println(" <p><font color='red'>");
	println(" Unable to determine current control set!<br />");
	println(" Are you sure you are running this report against the correct registry hive?");
	println(" </font></p>");
	}
	}
	diff --git a/trunk/report_templates/SYSTEM_UsbStorageDevices.qs b/trunk/report_templates/SYSTEM_UsbStorageDevices.qs
	index 20667d0..3c13418 100644
	--- a/trunk/report_templates/SYSTEM_UsbStorageDevices.qs
	+++ b/trunk/report_templates/SYSTEM_UsbStorageDevices.qs
	@@ -1,145 +1,190 @@
	function fred_report_info() {
	var info={report_cat : "SYSTEM",
	report_name : "USB storage devices",
	- report_author : "Gillen Daniel",
	+ report_author : "Gillen Daniel, Voncken Guy",
	report_desc : "Dump USB storage devices",
	fred_api : 2,
	hive : "SYSTEM"
	};
	return info;
	}

	+var table_style = "border-collapse:collapse; margin-left:20px; font-family:arial; font-size:12";
	+var cell_style = "border:1px solid #888888; padding:5; white-space:nowrap;";
	+
	function IsValid(val) {
	- if(typeof val !== 'undefined') return true;
	- else return false;
	+ return (typeof val!=='undefined');
	+}
	+
	+function PrintTableHeaderCell(str) {
	+ println(" <th style=\"",cell_style,"\">",str,"</th>");
	+}
	+
	+function PrintTableDataCell(alignment,str) {
	+ var style=cell_style+" text-align:"+alignment+";";
	+ println(" <td style=\"",style,"\">",str,"</td>");
	}

	-function print_table_row(cell01,cell02) {
	- println(" <tr><td>",cell01,"</td><td>",cell02,"</td></tr>");
	+function PrintTableDataRowSpanCell(alignment,rows,str) {
	+ var style=cell_style+" text-align: "+alignment+";";
	+ println(" <td rowspan=\"",rows,"\" style=\"",style,"\">",str,"</td>");
	}

	function ZeroPad(number,padlen) {
	var ret=number.toString(10);
	if(!padlen \|\| ret.length>=padlen) return ret;
	return Math.pow(10,padlen-ret.length).toString().slice(1)+ret;
	}

	+function GetKeyVal(path, key) {
	+ var val=GetRegistryKeyValue(path, key);
	+ return (IsValid(val)) ? RegistryKeyValueToString(val.value,val.type) : "";
	+}
	+
	function fred_report_html() {
	- // TODO: There is more here. Check http://www.forensicswiki.org/wiki/USB_History_Viewing
	+ // TODO: There is more here.
	+ // Check http://www.forensicswiki.org/wiki/USB_History_Viewing
	var val;

	println(" <h2>USB storage devices</h2>");

	- // Preload MountedDevices to possibly identify mount points of USB storage devices
	+ // Preload MountedDevices to possibly identify mount points of USB storage
	+ // devices
	var mnt_keys=GetRegistryKeys("\\MountedDevices");
	var mnt_values=new Array();
	if(IsValid(mnt_keys)) {
	for(var i=0;i<mnt_keys.length;i++) {
	val=GetRegistryKeyValue("\\MountedDevices",mnt_keys[i]);
	mnt_values[i]=RegistryKeyValueToVariant(val.value,"utf16");
	}
	}

	// Get current controlset
	var cur_controlset=GetRegistryKeyValue("\\Select","Current");
	if(IsValid(cur_controlset)) {
	- cur_controlset=RegistryKeyValueToString(cur_controlset.value,cur_controlset.type);
	+ cur_controlset=RegistryKeyValueToString(cur_controlset.value,
	+ cur_controlset.type);
	// Current holds a DWORD value, thus we get a string like 0x00000000, but
	// control sets are referenced by its decimal representation.
	- cur_controlset="ControlSet"+ZeroPad(parseInt(String(cur_controlset).substr(2,8),16),3)
	+ cur_controlset="ControlSet"+
	+ ZeroPad(parseInt(String(cur_controlset).substr(2,8),16),3);

	println(" <p style=\"font-size:12; white-space:nowrap\">");
	- println(" <u>Settings</u><br />");
	- println(" <table style=\"margin-left:20px; font-size:12; white-space:nowrap\">");
	+ println(" <table style=\""+table_style+"\">");

	// Are USB storage devices enabled?
	// http://www.forensicmag.com/article/windows-7-registry-forensics-part-5
	// Is this true for WinXP etc.. ???
	var val=GetRegistryKeyValue(cur_controlset+"\\services\\USBSTOR","Start");
	if(IsValid(val)) {
	val=RegistryKeyValueToString(val.value,val.type);
	val=parseInt(String(val).substr(2,8),10);
	switch(val) {
	case 3:
	- print_table_row("Storage driver enabled:","Yes");
	+ println(" <tr><td>Storage driver enabled:</td><td>Yes</td></tr>");
	break;
	case 4:
	- print_table_row("Storage driver enabled:","No");
	+ println(" <tr><td>Storage driver enabled:</td><td>No</td></tr>");
	break;
	default:
	- print_table_row("Storage driver enabled:","Unknown");
	+ println(" <tr><td>Storage driver enabled:</td><td>Unknown</td></tr>");
	}
	} else {
	- print_table_row("Storage driver enabled:","Unknown");
	+ println(" <tr><td>Storage driver enabled:</td><td>Unknown</td></tr>");
	}

	println(" </table>");
	println(" </p>");
	println(" <p style=\"font-size:12; white-space:nowrap\">");
	- println(" <u>Devices</u><br />");

	var storage_roots=GetRegistryNodes(cur_controlset+"\\Enum\\USBSTOR");
	if(IsValid(storage_roots)) {
	+ println(" <table style=\""+table_style+"\">");
	+ println(" <tr>");
	+ PrintTableHeaderCell("Vendor Name");
	+ PrintTableHeaderCell("Unique ID");
	+ PrintTableHeaderCell("Class");
	+ PrintTableHeaderCell("Friendly name");
	+ PrintTableHeaderCell("Mount point(s)");
	+ PrintTableHeaderCell("Parent ID");
	+ PrintTableHeaderCell("Device description");
	+ println(" </tr>");
	+
	for(var i=0;i<storage_roots.length;i++) {
	- println(" <u style=\"margin-left:20px; font-size:12; white-space:nowrap\">",storage_roots[i],"</u><br />");
	var storage_subroots=GetRegistryNodes(cur_controlset+"\\Enum\\USBSTOR\\"+storage_roots[i]);
	- for(ii=0;ii<storage_subroots.length;ii++) {
	- println(" <table style=\"margin-left:20px; font-size:12; white-space:nowrap\">");
	- // If the second character of the unique instance ID is a '&', then the ID was
	- // generated by the system, as the device did not have a serial number.
	- if(String(storage_subroots[ii]).charAt(1)=="&") print_table_row("Unique ID:",storage_subroots[ii]+" (Generated by system)");
	- else print_table_row("Unique ID:",storage_subroots[ii]);
	-
	- val=GetRegistryKeyValue(cur_controlset+"\\Enum\\USBSTOR\\"+storage_roots[i]+"\\"+storage_subroots[ii],"Class");
	- print_table_row("Class:",(IsValid(val)) ? RegistryKeyValueToString(val.value,val.type) : "");
	- val=GetRegistryKeyValue(cur_controlset+"\\Enum\\USBSTOR\\"+storage_roots[i]+"\\"+storage_subroots[ii],"DeviceDesc");
	- print_table_row("Device description:",(IsValid(val)) ? RegistryKeyValueToString(val.value,val.type) : "");
	- val=GetRegistryKeyValue(cur_controlset+"\\Enum\\USBSTOR\\"+storage_roots[i]+"\\"+storage_subroots[ii],"FriendlyName");
	- print_table_row("Friendly name:",(IsValid(val)) ? RegistryKeyValueToString(val.value,val.type) : "");
	- val=GetRegistryKeyValue(cur_controlset+"\\Enum\\USBSTOR\\"+storage_roots[i]+"\\"+storage_subroots[ii],"ParentIdPrefix");
	- if(IsValid(val)) {
	+ for(var ii=0;ii<storage_subroots.length;ii++) {
	+ var device_id=storage_subroots[ii];
	+ if(String(device_id).charAt(1)=="&") {
	+ // If the second character of the unique instance ID is a '&', then
	+ // the ID was generated by the system, as the device did not have a
	+ // serial number.
	+ device_id=device_id+" (Generated by system)";
	+ }
	+ var device_key=cur_controlset+"\\Enum\\USBSTOR\\"+storage_roots[i]+"\\"+storage_subroots[ii];
	+ var device_class=GetKeyVal(device_key,"Class");
	+ var device_desc=GetKeyVal(device_key,"DeviceDesc");
	+ var device_friendly_name=GetKeyVal(device_key,"FriendlyName");
	+ var device_parent_id=GetKeyVal(device_key,"ParentIdPrefix");
	+
	+ var search_string="";
	+ var device_mount_points=Array();
	+ if(device_parent_id != "") {
	// Windows XP uses the ParentId to link to MountedDevices
	- var parent_id=RegistryKeyValueToString(val.value,val.type);
	- print_table_row("Parent ID prefix:",parent_id);
	- // Find mount point(s)
	- print(" <tr><td>Mount point(s):</td><td>");
	- var br=0;
	- for(var iii=0;iii<mnt_keys.length;iii++) {
	- if(String(mnt_values[iii]).indexOf("#"+parent_id+"&")!=-1) {
	- if(br==1) print("<br />");
	- else br=1;
	- print(mnt_keys[iii]);
	- }
	- }
	- if(br==0) print("n/a");
	- println("</td></tr>");
	+ search_string="#"+device_parent_id+"&";
	} else {
	// Since Vista, Unique IDs are used
	- // Find mount point(s)
	- print(" <tr><td>Mount point(s):</td><td>");
	- var br=0;
	- for(var iii=0;iii<mnt_keys.length;iii++) {
	- if(String(mnt_values[iii]).indexOf("#"+storage_subroots[ii]+"#")!=-1) {
	- if(br==1) print("<br />");
	- else br=1;
	- print(mnt_keys[iii]);
	- }
	+ search_string="#"+storage_subroots[ii]+"#";
	+ }
	+ for(var iii=0; iii<mnt_keys.length; iii++) {
	+ if(String(mnt_values[iii]).indexOf(search_string)!=-1) {
	+ device_mount_points.push(mnt_keys[iii]);
	}
	- if(br==0) print("n/a");
	- println("</td></tr>");
	}
	- println(" </table>");
	- println(" <br />");
	+
	+ var mount_points=device_mount_points.length;
	+ if(mount_points>1) {
	+ println(" <tr>");
	+ PrintTableDataRowSpanCell("left",mount_points,storage_roots[i]);
	+ PrintTableDataRowSpanCell("left",mount_points,device_id);
	+ PrintTableDataRowSpanCell("left",mount_points,device_class);
	+ PrintTableDataRowSpanCell("left",mount_points,device_friendly_name);
	+ PrintTableDataCell("left",device_mount_points[0]);
	+ PrintTableDataRowSpanCell("left",mount_points,device_parent_id);
	+ PrintTableDataRowSpanCell("left",mount_points,device_desc);
	+ println(" </tr>");
	+ for(var iii=1;iii<device_mount_points.length;iii++) {
	+ println(" <tr>");
	+ PrintTableDataCell("left",device_mount_points[iii]);
	+ println(" </tr>");
	+ }
	+ } else {
	+ println(" <tr>");
	+ PrintTableDataCell("left",storage_roots[i]);
	+ PrintTableDataCell("left",device_id);
	+ PrintTableDataCell("left",device_class);
	+ PrintTableDataCell("left",device_friendly_name);
	+ if(mount_points!=0) {
	+ PrintTableDataCell("left",device_mount_points[0]);
	+ } else {
	+ PrintTableDataCell("left","n/a");
	+ }
	+ PrintTableDataCell("left",device_parent_id);
	+ PrintTableDataCell("left",device_desc);
	+ println(" </tr>");
	+ }
	}
	}
	+ println(" </table>");
	+ println(" <br />");
	} else {
	- println(" <font color='red'>This registry hive does not contain a list of attached USB storage devices!</font>");
	+ println(" <font color=\"red\">This registry hive does not contain a list of attached USB storage devices!</font>");
	}
	println(" </p>");
	} else {
	- println(" <p><font color='red'>");
	+ println(" <p><font color=\"red\">");
	println(" Unable to determine current control set!<br />");
	println(" Are you sure you are running this report against the correct registry hive?");
	println(" </font></p>");
	}
	}
	+
	diff --git a/trunk/report_templates/SYSTEM_UsbStorageDevices2.qs b/trunk/report_templates/SYSTEM_UsbStorageDevices2.qs
	deleted file mode 100644
	index 8fe3652..0000000
	--- a/trunk/report_templates/SYSTEM_UsbStorageDevices2.qs
	+++ /dev/null
	@@ -1,190 +0,0 @@
	-function fred_report_info() {
	- var info={report_cat : "SYSTEM",
	- report_name : "USB storage devices as table",
	- report_author : "Gillen Daniel, Voncken Guy",
	- report_desc : "Dump USB storage devices",
	- fred_api : 2,
	- hive : "SYSTEM"
	- };
	- return info;
	-}
	-
	-var table_style = "border-collapse:collapse; margin-left:20px; font-family:arial; font-size:12";
	-var cell_style = "border:1px solid #888888; padding:5; white-space:nowrap;";
	-
	-function IsValid(val) {
	- return (typeof val!=='undefined');
	-}
	-
	-function PrintTableHeaderCell(str) {
	- println(" <th style=\"",cell_style,"\">",str,"</th>");
	-}
	-
	-function PrintTableDataCell(alignment,str) {
	- var style=cell_style+" text-align:"+alignment+";";
	- println(" <td style=\"",style,"\">",str,"</td>");
	-}
	-
	-function PrintTableDataRowSpanCell(alignment,rows,str) {
	- var style=cell_style+" text-align: "+alignment+";";
	- println(" <td rowspan=\"",rows,"\" style=\"",style,"\">",str,"</td>");
	-}
	-
	-function ZeroPad(number,padlen) {
	- var ret=number.toString(10);
	- if(!padlen \|\| ret.length>=padlen) return ret;
	- return Math.pow(10,padlen-ret.length).toString().slice(1)+ret;
	-}
	-
	-function GetKeyVal(path, key) {
	- var val=GetRegistryKeyValue(path, key);
	- return (IsValid(val)) ? RegistryKeyValueToString(val.value,val.type) : "";
	-}
	-
	-function fred_report_html() {
	- // TODO: There is more here.
	- // Check http://www.forensicswiki.org/wiki/USB_History_Viewing
	- var val;
	-
	- println(" <h2>USB storage devices</h2>");
	-
	- // Preload MountedDevices to possibly identify mount points of USB storage
	- // devices
	- var mnt_keys=GetRegistryKeys("\\MountedDevices");
	- var mnt_values=new Array();
	- if(IsValid(mnt_keys)) {
	- for(var i=0;i<mnt_keys.length;i++) {
	- val=GetRegistryKeyValue("\\MountedDevices",mnt_keys[i]);
	- mnt_values[i]=RegistryKeyValueToVariant(val.value,"utf16");
	- }
	- }
	-
	- // Get current controlset
	- var cur_controlset=GetRegistryKeyValue("\\Select","Current");
	- if(IsValid(cur_controlset)) {
	- cur_controlset=RegistryKeyValueToString(cur_controlset.value,
	- cur_controlset.type);
	- // Current holds a DWORD value, thus we get a string like 0x00000000, but
	- // control sets are referenced by its decimal representation.
	- cur_controlset="ControlSet"+
	- ZeroPad(parseInt(String(cur_controlset).substr(2,8),16),3);
	-
	- println(" <p style=\"font-size:12; white-space:nowrap\">");
	- println(" <table style=\""+table_style+"\">");
	-
	- // Are USB storage devices enabled?
	- // http://www.forensicmag.com/article/windows-7-registry-forensics-part-5
	- // Is this true for WinXP etc.. ???
	- var val=GetRegistryKeyValue(cur_controlset+"\\services\\USBSTOR","Start");
	- if(IsValid(val)) {
	- val=RegistryKeyValueToString(val.value,val.type);
	- val=parseInt(String(val).substr(2,8),10);
	- switch(val) {
	- case 3:
	- println(" <tr><td>Storage driver enabled:</td><td>Yes</td></tr>");
	- break;
	- case 4:
	- println(" <tr><td>Storage driver enabled:</td><td>No</td></tr>");
	- break;
	- default:
	- println(" <tr><td>Storage driver enabled:</td><td>Unknown</td></tr>");
	- }
	- } else {
	- println(" <tr><td>Storage driver enabled:</td><td>Unknown</td></tr>");
	- }
	-
	- println(" </table>");
	- println(" </p>");
	- println(" <p style=\"font-size:12; white-space:nowrap\">");
	-
	- var storage_roots=GetRegistryNodes(cur_controlset+"\\Enum\\USBSTOR");
	- if(IsValid(storage_roots)) {
	- println(" <table style=\""+table_style+"\">");
	- println(" <tr>");
	- PrintTableHeaderCell("Vendor Name");
	- PrintTableHeaderCell("Unique ID");
	- PrintTableHeaderCell("Class");
	- PrintTableHeaderCell("Friendly name");
	- PrintTableHeaderCell("Mount point(s)");
	- PrintTableHeaderCell("Parent ID");
	- PrintTableHeaderCell("Device description");
	- println(" </tr>");
	-
	- for(var i=0;i<storage_roots.length;i++) {
	- var storage_subroots=GetRegistryNodes(cur_controlset+"\\Enum\\USBSTOR\\"+storage_roots[i]);
	- for(var ii=0;ii<storage_subroots.length;ii++) {
	- var device_id=storage_subroots[ii];
	- if(String(device_id).charAt(1)=="&") {
	- // If the second character of the unique instance ID is a '&', then
	- // the ID was generated by the system, as the device did not have a
	- // serial number.
	- device_id=device_id+" (Generated by system)";
	- }
	- var device_key=cur_controlset+"\\Enum\\USBSTOR\\"+storage_roots[i]+"\\"+storage_subroots[ii];
	- var device_class=GetKeyVal(device_key,"Class");
	- var device_desc=GetKeyVal(device_key,"DeviceDesc");
	- var device_friendly_name=GetKeyVal(device_key,"FriendlyName");
	- var device_parent_id=GetKeyVal(device_key,"ParentIdPrefix");
	-
	- var search_string="";
	- var device_mount_points=Array();
	- if(device_parent_id != "") {
	- // Windows XP uses the ParentId to link to MountedDevices
	- search_string="#"+device_parent_id+"&";
	- } else {
	- // Since Vista, Unique IDs are used
	- search_string="#"+storage_subroots[ii]+"#";
	- }
	- for(var iii=0; iii<mnt_keys.length; iii++) {
	- if(String(mnt_values[iii]).indexOf(search_string)!=-1) {
	- device_mount_points.push(mnt_keys[iii]);
	- }
	- }
	-
	- var mount_points=device_mount_points.length;
	- if(mount_points>1) {
	- println(" <tr>");
	- PrintTableDataRowSpanCell("left",mount_points,storage_roots[i]);
	- PrintTableDataRowSpanCell("left",mount_points,device_id);
	- PrintTableDataRowSpanCell("left",mount_points,device_class);
	- PrintTableDataRowSpanCell("left",mount_points,device_friendly_name);
	- PrintTableDataCell("left",device_mount_points[0]);
	- PrintTableDataRowSpanCell("left",mount_points,device_parent_id);
	- PrintTableDataRowSpanCell("left",mount_points,device_desc);
	- println(" </tr>");
	- for(var iii=1;iii<device_mount_points.length;iii++) {
	- println(" <tr>");
	- PrintTableDataCell("left",device_mount_points[iii]);
	- println(" </tr>");
	- }
	- } else {
	- println(" <tr>");
	- PrintTableDataCell("left",storage_roots[i]);
	- PrintTableDataCell("left",device_id);
	- PrintTableDataCell("left",device_class);
	- PrintTableDataCell("left",device_friendly_name);
	- if(mount_points!=0) {
	- PrintTableDataCell("left",device_mount_points[0]);
	- } else {
	- PrintTableDataCell("left","n/a");
	- }
	- PrintTableDataCell("left",device_parent_id);
	- PrintTableDataCell("left",device_desc);
	- println(" </tr>");
	- }
	- }
	- }
	- println(" </table>");
	- println(" <br />");
	- } else {
	- println(" <font color=\"red\">This registry hive does not contain a list of attached USB storage devices!</font>");
	- }
	- println(" </p>");
	- } else {
	- println(" <p><font color=\"red\">");
	- println(" Unable to determine current control set!<br />");
	- println(" Are you sure you are running this report against the correct registry hive?");
	- println(" </font></p>");
	- }
	-}
	-
	diff --git a/trunk/report_templates/SYSTEM_UsbStorageDevices.qs b/trunk/report_templates/SYSTEM_UsbStorageDevices_old.qs
	similarity index 99%
	copy from trunk/report_templates/SYSTEM_UsbStorageDevices.qs
	copy to trunk/report_templates/SYSTEM_UsbStorageDevices_old.qs
	index 20667d0..a36c041 100644
	--- a/trunk/report_templates/SYSTEM_UsbStorageDevices.qs
	+++ b/trunk/report_templates/SYSTEM_UsbStorageDevices_old.qs
	@@ -1,145 +1,145 @@
	function fred_report_info() {
	var info={report_cat : "SYSTEM",
	- report_name : "USB storage devices",
	+ report_name : "OLD - USB storage devices",
	report_author : "Gillen Daniel",
	report_desc : "Dump USB storage devices",
	fred_api : 2,
	hive : "SYSTEM"
	};
	return info;
	}

	function IsValid(val) {
	if(typeof val !== 'undefined') return true;
	else return false;
	}

	function print_table_row(cell01,cell02) {
	println(" <tr><td>",cell01,"</td><td>",cell02,"</td></tr>");
	}

	function ZeroPad(number,padlen) {
	var ret=number.toString(10);
	if(!padlen \|\| ret.length>=padlen) return ret;
	return Math.pow(10,padlen-ret.length).toString().slice(1)+ret;
	}

	function fred_report_html() {
	// TODO: There is more here. Check http://www.forensicswiki.org/wiki/USB_History_Viewing
	var val;

	println(" <h2>USB storage devices</h2>");

	// Preload MountedDevices to possibly identify mount points of USB storage devices
	var mnt_keys=GetRegistryKeys("\\MountedDevices");
	var mnt_values=new Array();
	if(IsValid(mnt_keys)) {
	for(var i=0;i<mnt_keys.length;i++) {
	val=GetRegistryKeyValue("\\MountedDevices",mnt_keys[i]);
	mnt_values[i]=RegistryKeyValueToVariant(val.value,"utf16");
	}
	}

	// Get current controlset
	var cur_controlset=GetRegistryKeyValue("\\Select","Current");
	if(IsValid(cur_controlset)) {
	cur_controlset=RegistryKeyValueToString(cur_controlset.value,cur_controlset.type);
	// Current holds a DWORD value, thus we get a string like 0x00000000, but
	// control sets are referenced by its decimal representation.
	cur_controlset="ControlSet"+ZeroPad(parseInt(String(cur_controlset).substr(2,8),16),3)

	println(" <p style=\"font-size:12; white-space:nowrap\">");
	println(" <u>Settings</u><br />");
	println(" <table style=\"margin-left:20px; font-size:12; white-space:nowrap\">");

	// Are USB storage devices enabled?
	// http://www.forensicmag.com/article/windows-7-registry-forensics-part-5
	// Is this true for WinXP etc.. ???
	var val=GetRegistryKeyValue(cur_controlset+"\\services\\USBSTOR","Start");
	if(IsValid(val)) {
	val=RegistryKeyValueToString(val.value,val.type);
	val=parseInt(String(val).substr(2,8),10);
	switch(val) {
	case 3:
	print_table_row("Storage driver enabled:","Yes");
	break;
	case 4:
	print_table_row("Storage driver enabled:","No");
	break;
	default:
	print_table_row("Storage driver enabled:","Unknown");
	}
	} else {
	print_table_row("Storage driver enabled:","Unknown");
	}

	println(" </table>");
	println(" </p>");
	println(" <p style=\"font-size:12; white-space:nowrap\">");
	println(" <u>Devices</u><br />");

	var storage_roots=GetRegistryNodes(cur_controlset+"\\Enum\\USBSTOR");
	if(IsValid(storage_roots)) {
	for(var i=0;i<storage_roots.length;i++) {
	println(" <u style=\"margin-left:20px; font-size:12; white-space:nowrap\">",storage_roots[i],"</u><br />");
	var storage_subroots=GetRegistryNodes(cur_controlset+"\\Enum\\USBSTOR\\"+storage_roots[i]);
	for(ii=0;ii<storage_subroots.length;ii++) {
	println(" <table style=\"margin-left:20px; font-size:12; white-space:nowrap\">");
	// If the second character of the unique instance ID is a '&', then the ID was
	// generated by the system, as the device did not have a serial number.
	if(String(storage_subroots[ii]).charAt(1)=="&") print_table_row("Unique ID:",storage_subroots[ii]+" (Generated by system)");
	else print_table_row("Unique ID:",storage_subroots[ii]);

	val=GetRegistryKeyValue(cur_controlset+"\\Enum\\USBSTOR\\"+storage_roots[i]+"\\"+storage_subroots[ii],"Class");
	print_table_row("Class:",(IsValid(val)) ? RegistryKeyValueToString(val.value,val.type) : "");
	val=GetRegistryKeyValue(cur_controlset+"\\Enum\\USBSTOR\\"+storage_roots[i]+"\\"+storage_subroots[ii],"DeviceDesc");
	print_table_row("Device description:",(IsValid(val)) ? RegistryKeyValueToString(val.value,val.type) : "");
	val=GetRegistryKeyValue(cur_controlset+"\\Enum\\USBSTOR\\"+storage_roots[i]+"\\"+storage_subroots[ii],"FriendlyName");
	print_table_row("Friendly name:",(IsValid(val)) ? RegistryKeyValueToString(val.value,val.type) : "");
	val=GetRegistryKeyValue(cur_controlset+"\\Enum\\USBSTOR\\"+storage_roots[i]+"\\"+storage_subroots[ii],"ParentIdPrefix");
	if(IsValid(val)) {
	// Windows XP uses the ParentId to link to MountedDevices
	var parent_id=RegistryKeyValueToString(val.value,val.type);
	print_table_row("Parent ID prefix:",parent_id);
	// Find mount point(s)
	print(" <tr><td>Mount point(s):</td><td>");
	var br=0;
	for(var iii=0;iii<mnt_keys.length;iii++) {
	if(String(mnt_values[iii]).indexOf("#"+parent_id+"&")!=-1) {
	if(br==1) print("<br />");
	else br=1;
	print(mnt_keys[iii]);
	}
	}
	if(br==0) print("n/a");
	println("</td></tr>");
	} else {
	// Since Vista, Unique IDs are used
	// Find mount point(s)
	print(" <tr><td>Mount point(s):</td><td>");
	var br=0;
	for(var iii=0;iii<mnt_keys.length;iii++) {
	if(String(mnt_values[iii]).indexOf("#"+storage_subroots[ii]+"#")!=-1) {
	if(br==1) print("<br />");
	else br=1;
	print(mnt_keys[iii]);
	}
	}
	if(br==0) print("n/a");
	println("</td></tr>");
	}
	println(" </table>");
	println(" <br />");
	}
	}
	} else {
	println(" <font color='red'>This registry hive does not contain a list of attached USB storage devices!</font>");
	}
	println(" </p>");
	} else {
	println(" <p><font color='red'>");
	println(" Unable to determine current control set!<br />");
	println(" Are you sure you are running this report against the correct registry hive?");
	println(" </font></p>");
	}
	}

File Metadata

Mime Type: text/x-diff
Expires: Tue, Dec 24, 3:13 AM (1 d, 8 h)
Storage Engine: blob
Storage Format: Raw Data
Storage Handle: 1176834
Default Alt Text: (53 KB)

No OneTemporaryActions

View Options

File Metadata

Event Timeline

No OneTemporary
Actions