# Automated USB Parsers Tools

## &#x20;**Streamlining Forensic Investigations**

In this lesson, we focus on **USB Detective**, a powerful automated tool designed to simplify USB forensic investigations. By parsing USB-related artifacts and presenting the data in a structured format, USB Detective significantly reduces manual effort and accelerates analysis.

***

## **What is USB Detective?**

USB Detective automates the extraction and analysis of critical USB activity, including:

* **USB Connection History**
* **Device Metadata**
* **Key Timestamps**:
  * First Connection
  * Last Connection
  * Disconnection Time
* **Files and Folders Accessed via USB**

**Supported Artifacts for Parsing**:

* **Registry Hives**:
  * NTUSER.dat
  * SYSTEM
* **Event Logs**

***



## **Acquiring Artifacts with KAPE**

Before using USB Detective, you’ll need to gather relevant artifacts with **KAPE** (Kroll Artifact Parser and Extractor). These artifacts include:

* SYSTEM
* NTUSER.dat
* USRCLASS.dat
* Event Logs

***

## **Using USB Detective**

### **Step 1: Launch USB Detective**

* Open the tool and click **"Select Files/Folders"** on the main interface.

### **Step 2: Input Case Information**

* Enter the **Case Name**.
* Specify a **Directory** for results.
* Add the folder containing **acquired artifacts** such as registry hives and logs.

#### **Step 3: Analyze USB Data**

* Load the artifacts to begin parsing.
* Example: If only one USB device was connected, a single result will appear.

***

## **Exploring Results**

USB Detective presents parsed data in an easy-to-navigate format, including:

### **1. USB Device Information**

* **Manufacturer**
* **Model**
* **Serial Number**

### **2. Key Timestamps**

* **First Connection**
* **Last Connection**
* **Disconnection Time**

### **3. File/Folder Access**

* **Paths and Names** of accessed files/folders.
* **Access Timestamps** for each item.

***

#### **Conclusion**

**USB Detective** streamlines the traditionally labor-intensive process of analyzing USB activities by automating the extraction and presentation of:

* Critical **timestamps**
* Accessed **files and folders**
* Detailed **device metadata**

This enables rapid, efficient USB forensic investigations, saving time and effort.
