Skip to main content

USBs

Artemis support attempting to extract USB devices that have been connected to the Windows system. It will parse the SYSTEM Registry file to look for USB devices that have been connected.

References:

Collection

You have to use the artemis api in order to collect MRU keys.

Sample API Script

import { listUsbDevices } from "./artemis-api/src/windows/registry/usb.ts";

function main() {
  const results = listUsbDevices();
  console.log(results);
}

Output Structure

An array of UsbDevices

export interface UsbDevices {
  device_class_id: string;
  friendly_name: string;
  /**Last drive letter assigned to the USB */
  drive_letter: string;
  last_connected: string;
  last_insertion: string;
  last_removal: string;
  install: string;
  first_install: string;
  usb_type: string;
  vendor: string;
  product: string;
  revision: string;
  tracking_id: string;
  disk_id: string;
}