diff --git a/trunk/report_templates/SYSTEM_UsbStorageDevices.qs b/trunk/report_templates/SYSTEM_UsbStorageDevices.qs
index 32d7353..65b6e5b 100644
--- a/trunk/report_templates/SYSTEM_UsbStorageDevices.qs
+++ b/trunk/report_templates/SYSTEM_UsbStorageDevices.qs
@@ -1,43 +1,68 @@
// TODO: There is more here. Check http://www.forensicswiki.org/wiki/USB_History_Viewing
function print_table_row(cell01,cell02) {
println("
",cell01," | ",cell02," |
");
}
// Global vars
var val;
+// Preload MountedDevices to possibly identify mount points of USB storage devices
+var mnt_keys=GetRegistryKeys("\\MountedDevices");
+var mnt_values=new Array();
+for(var i=0;i");
println(" USB Storage Devices");
println(" ");
println(" USB storage devices
");
println(" ");
var storage_roots=GetRegistryNodes(cur_controlset+"\\Enum\\USBSTOR");
for(var i=0;i",storage_roots[i],"
");
var storage_subroots=GetRegistryNodes(cur_controlset+"\\Enum\\USBSTOR\\"+storage_roots[i]);
for(ii=0;ii");
- // Note: If the second character of the unique instance ID is a '&', then the ID was
+ // If the second character of the unique instance ID is a '&', then the ID was
// generated by the system, as the device did not have a serial number.
- print_table_row("Unique ID:",storage_subroots[ii]);
+ if(String(storage_subroots[ii]).charAt(1)=="&") print_table_row("Unique ID:",storage_subroots[ii]+" (Generated by system)");
+ else print_table_row("Unique ID:",storage_subroots[ii]);
val=GetRegistryKeyValue(cur_controlset+"\\Enum\\USBSTOR\\"+storage_roots[i]+"\\"+storage_subroots[ii],"Class");
print_table_row("Class:",(typeof val !== 'undefined') ? RegistryKeyValueToString(val.value,val.type) : "");
val=GetRegistryKeyValue(cur_controlset+"\\Enum\\USBSTOR\\"+storage_roots[i]+"\\"+storage_subroots[ii],"DeviceDesc");
print_table_row("Device description:",(typeof val !== 'undefined') ? RegistryKeyValueToString(val.value,val.type) : "");
val=GetRegistryKeyValue(cur_controlset+"\\Enum\\USBSTOR\\"+storage_roots[i]+"\\"+storage_subroots[ii],"FriendlyName");
print_table_row("Friendly name:",(typeof val !== 'undefined') ? RegistryKeyValueToString(val.value,val.type) : "");
+ val=GetRegistryKeyValue(cur_controlset+"\\Enum\\USBSTOR\\"+storage_roots[i]+"\\"+storage_subroots[ii],"ParentIdPrefix");
+ if(typeof val !== 'undefined') {
+ var parent_id=RegistryKeyValueToString(val.value,val.type);
+ print_table_row("Parent ID prefix:",parent_id);
+ // Find mount point(s)
+ print(" Mount point(s): | ");
+ var br=0;
+ for(var iii=0;iii");
+ else br=1;
+ print(mnt_keys[iii]);
+ }
+ }
+ println(" |
");
+ } else print_table_row("Parent ID prefix:","n/a");
}
}
println("
");
println("");