Skip to main content

USBs

Artemis support attempting to extract USB devices that have been connected to the Windows system. It will parse the SYSTEM Registry file to look for USB devices that have been connected.

References:

Collection​

You have to use the artemis api in order to collect USBs keys.

Sample API Script​

import { listUsbDevices } from "./artemis-api/src/windows/registry/usb";

function main() {
  const results = listUsbDevices();
  console.log(results);
}

Output Structure​

An array of UsbDevices

export interface UsbDevices {
  device_class_id: string;
  friendly_name: string;
  /**Last drive letter assigned to the USB */
  drive_letter: string;
  last_connected: string;
  last_insertion: string;
  last_removal: string;
  install: string;
  first_install: string;
  usb_type: string;
  vendor: string;
  product: string;
  revision: string;
  tracking_id: string;
  disk_id: string;
  message: string;
  datetime: string;
  timestamp_desc: "USB Last Connected";
  artifact: "Windows USB Device";
  data_type: "windows:registry:usb:entry";
  evidence: string;
}