diff --git a/trunk/report_templates/SYSTEM_UsbStorageDevices2.qs b/trunk/report_templates/SYSTEM_UsbStorageDevices2.qs new file mode 100644 index 0000000..0b11e6a --- /dev/null +++ b/trunk/report_templates/SYSTEM_UsbStorageDevices2.qs @@ -0,0 +1,181 @@ +function fred_report_info() { + var info={report_cat : "SYSTEM", + report_name : "USB storage devices as table", + report_author : "Gillen Daniel, Voncken Guy", + report_desc : "Dump USB storage devices", + fred_api : 2, + hive : "SYSTEM" + }; + return info; +} + +function IsValid(val) { + if(typeof val !== 'undefined') return true; + else return false; +} + +function print_table_row(cell01,cell02) { + println(" ",cell01,"",cell02,""); +} + +function print_dev_table_row(VendorProd, + ID, + Class, + Name, + MountPoint, + ParentId, + Desc) +{ + println(" "); + println(" ",VendorProd,""); + println(" ",ID,""); + println(" ",Class,""); + println(" ",Name,""); + println(" ",MountPoint,""); + println(" ",ParentId,""); + println(" ",Desc,""); + println(" "); +} + +function ZeroPad(number,padlen) { + var ret=number.toString(10); + if(!padlen || ret.length>=padlen) return ret; + return Math.pow(10,padlen-ret.length).toString().slice(1)+ret; +} + +function GetKeyVal(path, key) { + var val=GetRegistryKeyValue(path, key); + return (IsValid(val)) ? RegistryKeyValueToString(val.value,val.type) : ""; +} + +function fred_report_html() { + // TODO: There is more here. + // Check http://www.forensicswiki.org/wiki/USB_History_Viewing + var val; + + println("

USB storage devices

"); + + // Preload MountedDevices to possibly identify mount points of USB storage + // devices + var mnt_keys=GetRegistryKeys("\\MountedDevices"); + var mnt_values=new Array(); + if(IsValid(mnt_keys)) { + for(var i=0;i"); + println(" Settings
"); + println(" "); + + // Are USB storage devices enabled? + // http://www.forensicmag.com/article/windows-7-registry-forensics-part-5 + // Is this true for WinXP etc.. ??? + var val=GetRegistryKeyValue(cur_controlset+"\\services\\USBSTOR","Start"); + if(IsValid(val)) { + val=RegistryKeyValueToString(val.value,val.type); + val=parseInt(String(val).substr(2,8),10); + switch(val) { + case 3: + print_table_row("Storage driver enabled:","Yes"); + break; + case 4: + print_table_row("Storage driver enabled:","No"); + break; + default: + print_table_row("Storage driver enabled:","Unknown"); + } + } else { + print_table_row("Storage driver enabled:","Unknown"); + } + + println("
"); + println("

"); + println("

"); + println(" Devices
"); + + var storage_roots=GetRegistryNodes(cur_controlset+"\\Enum\\USBSTOR"); + if(IsValid(storage_roots)) { + println(" "); + print_dev_table_row("Vendor Name", + "Unique ID", + "Class", + "Friendly name", + "Mount point(s)", + "Parent ID", + "Device description"); + for(var i=0; i"; + else br=1; + MountPoints = MountPoints + mnt_keys[iii]; + } + } + if(br==0) MountPoints = MountPoints + "n/a"; + + print_dev_table_row(storage_roots[i], + ID, + Class, + FriendlyName, + MountPoints, + ParentID, + DeviceDesc); + } + } + println("
"); + println("
"); + } else { + println(" This registry hive does not contain a ", + "list of attached USB storage devices!"); + } + println("

"); + } else { + println("

"); + println(" Unable to determine current control set!
"); + println(" Are you sure you are running this report against the correct ", + "registry hive?"); + println("

"); + } +} +