Automated USB Parsers Tools

Streamlining Forensic Investigations

In this lesson, we focus on USB Detective, a powerful automated tool designed to simplify USB forensic investigations. By parsing USB-related artifacts and presenting the data in a structured format, USB Detective significantly reduces manual effort and accelerates analysis.

---

What is USB Detective?

USB Detective automates the extraction and analysis of critical USB activity, including:

• USB Connection History

• Device Metadata

• Key Timestamps:

  • First Connection

  • Last Connection

  • Disconnection Time

• Files and Folders Accessed via USB

Supported Artifacts for Parsing:

• Registry Hives:

  • NTUSER.dat

  • SYSTEM

• Event Logs

---

Acquiring Artifacts with KAPE

Before using USB Detective, you’ll need to gather relevant artifacts with KAPE (Kroll Artifact Parser and Extractor). These artifacts include:

• SYSTEM

• NTUSER.dat

• USRCLASS.dat

• Event Logs

---

Using USB Detective

Step 1: Launch USB Detective

• Open the tool and click "Select Files/Folders" on the main interface.

Step 2: Input Case Information

• Enter the Case Name.

• Specify a Directory for results.

• Add the folder containing acquired artifacts such as registry hives and logs.

Step 3: Analyze USB Data

• Load the artifacts to begin parsing.

• Example: If only one USB device was connected, a single result will appear.

---

Exploring Results

USB Detective presents parsed data in an easy-to-navigate format, including:

1. USB Device Information

• Manufacturer

• Model

• Serial Number

2. Key Timestamps

• First Connection

• Last Connection

• Disconnection Time

3. File/Folder Access

• Paths and Names of accessed files/folders.

• Access Timestamps for each item.

---

Conclusion

USB Detective streamlines the traditionally labor-intensive process of analyzing USB activities by automating the extraction and presentation of:

• Critical timestamps

• Accessed files and folders

• Detailed device metadata

This enables rapid, efficient USB forensic investigations, saving time and effort.