Skip to content

Usb device parser #7963

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 23 commits into
base: develop
Choose a base branch
from
Open

Usb device parser #7963

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
23 commits
Select commit Hold shift + click to select a range
0712c16
Initial commit
markmckinnon Mar 24, 2025
530d570
Create usbparser.exe
markmckinnon Mar 30, 2025
5510b84
Update usbparser.exe
markmckinnon Mar 31, 2025
4e13501
Update ExtractUsb.java
markmckinnon Mar 31, 2025
457c582
Update ExtractRegistry.java
markmckinnon Mar 31, 2025
90520a6
Update RAImageIngestModule.java
markmckinnon Mar 31, 2025
6a34481
Update Bundle.properties-MERGED
markmckinnon Mar 31, 2025
845fa5a
Merge pull request #7957 from markmckinnon/TSK-4.14.0
markmckinnon Apr 9, 2025
a756a04
Merge pull request #7959 from markmckinnon/Uprade-version-Number-to-4…
markmckinnon Apr 9, 2025
84bdeff
Merge remote-tracking branch 'upstream/release-4.22.1' into USB-Devic…
markmckinnon Apr 14, 2025
43cb78e
Update ExtractUsb.java
markmckinnon Apr 15, 2025
787aff0
Merge remote-tracking branch 'upstream/develop' into USB-Device-Parser
markmckinnon Apr 17, 2025
559efef
Update
markmckinnon Apr 17, 2025
c6006a6
Update ExtractRegistry.java
markmckinnon Apr 18, 2025
4805007
Create usbparser
markmckinnon Apr 18, 2025
3ce67ed
Merge remote-tracking branch 'upstream/develop' into USB-Device-Parser
markmckinnon Oct 28, 2025
3e20707
Update PlatformUtil.java
markmckinnon Oct 28, 2025
d31dce2
Update usb executable
markmckinnon Oct 28, 2025
37549cb
Update ExtractUsb.java
markmckinnon Oct 28, 2025
fdc2a79
Update Bundle.properties-MERGED
markmckinnon Oct 28, 2025
e295854
fix file name
markmckinnon Oct 29, 2025
495f368
Update ExtractUsb.java
markmckinnon Oct 29, 2025
cafcf49
Update PlatformUtil.java
markmckinnon Nov 10, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 18 additions & 0 deletions Core/src/org/sleuthkit/autopsy/coreutils/PlatformUtil.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -340,6 +340,24 @@ public static boolean isWindowsOS() {
return PlatformUtil.getOSName().toLowerCase().contains("windows"); //NON-NLS
}

/**
* Check if running on Linux OS
*
* @return true if running on Linux OS
*/
public static boolean isLinuxOS() {
return PlatformUtil.getOSName().toLowerCase().contains("linux"); //NON-NLS
}

/**
* Check if running on Macos OS
*
* @return true if running on Macos OS
*/
public static boolean isMacOS() {
return PlatformUtil.getOSName().toLowerCase().contains("mac"); //NON-NLS
}

/**
* Convert file path (quote) for OS specific
*
Expand Down
24 changes: 24 additions & 0 deletions RecentActivity/src/org/sleuthkit/autopsy/recentactivity/Bundle.properties-MERGED
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,7 @@ DefaultPriorityDomainCategorizer_searchEngineCategory=Search Engine
DomainCategoryRunner_moduleName_text=Domain Category Analyzer
DomainCategoryRunner_parentModuleName=Recent Activity
DomainCategoryRunner_Progress_Message_Domain_Types=Finding Domain Types
EventPartitionLog_Not_Found=Event Log Partition information not found
ExtractEdge_getHistory_containerFileNotFound=Error while trying to analyze Edge history
ExtractEdge_Module_Name=Microsoft Edge Analyzer
ExtractEdge_process_errMsg_errGettingWebCacheFiles=Error trying to retrieving Edge WebCacheV01 file
Expand Down Expand Up @@ -75,6 +76,15 @@ ExtractSru_process_errormsg_find_software_hive=Unable to find SOFTWARE HIVE file
ExtractSru_process_errormsg_find_srudb_dat=Unable to find srudb.dat file
ExtractSru_process_errormsg_write_software_hive=Unable to write SOFTWARE HIVE file
ExtractSru_process_errormsg_write_srudb_dat=Unable to write srudb.dat file
ExtractUsb_error_finding_usbparser_program=Error finding usbparser program
ExtractUsb_module_name=USB Analyzer
ExtractUsb_process_error_executing_export_srudb_program=Error running usbparser program
ExtractUsb_process_errormsg_find_evtx=Unable to find evtx file
ExtractUsb_process_errormsg_find_hive=Unable to find HIVE file
ExtractUsb_process_errormsg_find_lnk=Unable to find lnk file
ExtractUsb_process_errormsg_write_evtx=Unable to write evtx file
ExtractUsb_process_errormsg_write_hive=Unable to write HIVE file
ExtractUsb_process_errormsg_write_lnk=Unable to write lnk file
ExtractWebAccountType.role.admin=Administrator role
ExtractWebAccountType.role.moderator=Moderator role
ExtractWebAccountType.role.user=User role
Expand Down Expand Up @@ -260,4 +270,18 @@ ExtractWebAccountType.parentModuleName=Recent Activity
Shellbag_Artifact_Display_Name=Shell Bags
Shellbag_Key_Attribute_Display_Name=Key
Shellbag_Last_Write_Attribute_Display_Name=Last Write
SoftwareHiveFile_Not_Found=SOFTWARE hive file not found
SystemHiveFile_Not_Found=SYSTEM hive file not found
Usb_Artifact_Connect_Disconnect=USB Connects/Disconnects
Usb_Artifact_Name=USB Removable Device
Usb_connect_disconnect=Connection Type
Usb_disconnectedTime=Disconnected Time
Usb_diskSignature=Disk Signature
Usb_driveLetter=Drive Letter
Usb_fileSystem=File System
Usb_firstConnectTime=First Connect Time
Usb_lastConnectTime=Last Connect Time
Usb_serialNumber=Serial Number
Usb_volumeName=Volume Label
Usb_vsn=Volume Serial Number
UsbDeviceIdMapper.parseAndLookup.text=Product: {0}
56 changes: 28 additions & 28 deletions RecentActivity/src/org/sleuthkit/autopsy/recentactivity/ExtractRegistry.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -766,34 +766,34 @@ private boolean parseAutopsyPluginOutput(String regFilePath, AbstractFile regFil
// @@@ BC: Why are we ignoring this...
break;
case "usb": //NON-NLS
try {
Long usbMtime = Long.valueOf("0");
if (!artnode.getAttribute("mtime").isEmpty()) {
usbMtime = Long.parseLong(artnode.getAttribute("mtime")); //NON-NLS
}
usbMtime = Long.valueOf(usbMtime.toString());
if (usbMtime > 0) {
bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_DATETIME, parentModuleName, usbMtime));
}
String dev = artnode.getAttribute("dev"); //NON-NLS
String make = "";
String model = dev;
if (dev.toLowerCase().contains("vid")) { //NON-NLS
USBInfo info = USB_MAPPER.parseAndLookup(dev);
if (info.getVendor() != null) {
make = info.getVendor();
}
if (info.getProduct() != null) {
model = info.getProduct();
}
}
bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_DEVICE_MAKE, parentModuleName, make));
bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_DEVICE_MODEL, parentModuleName, model));
bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_DEVICE_ID, parentModuleName, value));
newArtifacts.add(createArtifactWithAttributes(BlackboardArtifact.Type.TSK_DEVICE_ATTACHED, regFile, bbattributes));
} catch (TskCoreException ex) {
logger.log(Level.SEVERE, String.format("Error adding device_attached artifact to blackboard for file %d.", regFile.getId()), ex); //NON-NLS
}
// replaced by new USB Parsing,
//try {
// Long usbMtime = Long.valueOf("0");
// if (!artnode.getAttribute("mtime").isEmpty()) {
// usbMtime = Long.parseLong(artnode.getAttribute("mtime")); //NON-NLS
// }
// usbMtime = Long.valueOf(usbMtime.toString());
// if (usbMtime > 0) {
// bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_DATETIME, parentModuleName, usbMtime));
// }
// String dev = artnode.getAttribute("dev"); //NON-NLS
// String make = "";
// String model = dev;
// if (dev.toLowerCase().contains("vid")) { //NON-NLS
// USBInfo info = USB_MAPPER.parseAndLookup(dev);
// if (info.getVendor() != null) {
// make = info.getVendor();
// }
// if (info.getProduct() != null) {
// model = info.getProduct();
// }
// }
// bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_DEVICE_MAKE, parentModuleName, make));
// bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_DEVICE_MODEL, parentModuleName, model));
// bbattributes.add(new BlackboardAttribute(ATTRIBUTE_TYPE.TSK_DEVICE_ID, parentModuleName, value));
// newArtifacts.add(createArtifactWithAttributes(BlackboardArtifact.Type.TSK_DEVICE_ATTACHED, regFile, bbattributes));
//} catch (TskCoreException ex) {
// logger.log(Level.SEVERE, String.format("Error adding device_attached artifact to blackboard for file %d.", regFile.getId()), ex); //NON-NLS }
break;
case "uninstall": //NON-NLS
Long itemMtime = null;
Expand Down
Loading