diff --git a/trunk/report_templates/SYSTEM_UsbStorageDevices.qs b/trunk/report_templates/SYSTEM_UsbStorageDevices.qs index 32d7353..65b6e5b 100644 --- a/trunk/report_templates/SYSTEM_UsbStorageDevices.qs +++ b/trunk/report_templates/SYSTEM_UsbStorageDevices.qs @@ -1,43 +1,68 @@ // TODO: There is more here. Check http://www.forensicswiki.org/wiki/USB_History_Viewing function print_table_row(cell01,cell02) { println(" ",cell01,"",cell02,""); } // Global vars var val; +// Preload MountedDevices to possibly identify mount points of USB storage devices +var mnt_keys=GetRegistryKeys("\\MountedDevices"); +var mnt_values=new Array(); +for(var i=0;i"); println(" USB Storage Devices"); println(" "); println("

USB storage devices

"); println("

"); var storage_roots=GetRegistryNodes(cur_controlset+"\\Enum\\USBSTOR"); for(var i=0;i",storage_roots[i],"
"); var storage_subroots=GetRegistryNodes(cur_controlset+"\\Enum\\USBSTOR\\"+storage_roots[i]); for(ii=0;ii"); - // Note: If the second character of the unique instance ID is a '&', then the ID was + // If the second character of the unique instance ID is a '&', then the ID was // generated by the system, as the device did not have a serial number. - print_table_row("Unique ID:",storage_subroots[ii]); + if(String(storage_subroots[ii]).charAt(1)=="&") print_table_row("Unique ID:",storage_subroots[ii]+" (Generated by system)"); + else print_table_row("Unique ID:",storage_subroots[ii]); val=GetRegistryKeyValue(cur_controlset+"\\Enum\\USBSTOR\\"+storage_roots[i]+"\\"+storage_subroots[ii],"Class"); print_table_row("Class:",(typeof val !== 'undefined') ? RegistryKeyValueToString(val.value,val.type) : ""); val=GetRegistryKeyValue(cur_controlset+"\\Enum\\USBSTOR\\"+storage_roots[i]+"\\"+storage_subroots[ii],"DeviceDesc"); print_table_row("Device description:",(typeof val !== 'undefined') ? RegistryKeyValueToString(val.value,val.type) : ""); val=GetRegistryKeyValue(cur_controlset+"\\Enum\\USBSTOR\\"+storage_roots[i]+"\\"+storage_subroots[ii],"FriendlyName"); print_table_row("Friendly name:",(typeof val !== 'undefined') ? RegistryKeyValueToString(val.value,val.type) : ""); + val=GetRegistryKeyValue(cur_controlset+"\\Enum\\USBSTOR\\"+storage_roots[i]+"\\"+storage_subroots[ii],"ParentIdPrefix"); + if(typeof val !== 'undefined') { + var parent_id=RegistryKeyValueToString(val.value,val.type); + print_table_row("Parent ID prefix:",parent_id); + // Find mount point(s) + print(" Mount point(s):"); + var br=0; + for(var iii=0;iii"); + else br=1; + print(mnt_keys[iii]); + } + } + println(""); + } else print_table_row("Parent ID prefix:","n/a"); } } println("

"); println("");