USBTracker - Tool To Track USB Devices Events and Artifacts In a Windows OS

USBTracker is a quick & dirty coded incident response and forensics Python script to dump USB related information and artifacts from a Windows OS (Vista and later).

Note: USBTracker read some protected log files and needs to be run with administrator permissions. The most simple way to run USBTracker is to launch a CMD or Powershell console with a right click "run as administrator", then execute the script/exe inside it.

If you don't have a python distribution installed on the computer you want to analyze with USBTracker, you can also download an *.exe "compiled" version with PyInstaller of the script from the repository.

It uses a Python module called  Python-evtx. So, don't forget to install it before using the USBTracker.

Usage:

usage: usbtracker.py [-h] [-u | -uu] [-nh] [-df] [-x]

optional arguments:
  -h, --help            show this help message and exit
  -u, --usbstor         Dump USB artifacts from USBSTOR registry
  -uu, --usbstor-verbose
                        Dump USB detailed artifacts from USBSTOR registry.
  -nh, --no-hardwareid  Hide HardwareID value during a USBSTOR detailed
                        artifacts registry dump.
  -df, --driver-frameworks
                        Dump USB artifacts and events from the Windows
                        DriverFrameworks Usermode log.
  -x, --raw-xml-event   Display event results in raw xml (with -df option
                        only).

Download USBTracker

You might also like:

• Introspy(iOS) - Tool For Blackbox iOS App Analysis
• LinEnum - Local Linux Enumeration & Privilege Escalation Script
• Vulscan - Advanced Vulnerability Scanning with Nmap
• pWeb Suite - Web Application Penetration Testing Toolkit
• OWASP Bricks - Web Application Security Learning Platform
• WebVulScan - Web Application Vulnerability Scanner
• Zarp - Network Attack Tool
• bWAPP - An Extremely Buggy Web App For Practising Hacking
• bee-box - A Custom Linux VM Pre-installed with bWAPP
• HconSTF - An Open Source Security Assessment Toolkit
• pytbull - Intrusion Detection/Prevention System (IDS/IPS) Testing Framework
• RIPS - Tool For Detecting Vulnerabilities in PHP Applications
• Samurai Web Testing Framework - A Virtual Machine Focused on Web Application Testing
• Nessus - An Advanced Vulnerability Scanner
• Resolver - A Reverse DNS Lookup Tool
• Arachni - Web Application Security Scanner Framework
• Sanewall - A Firewall Builder For Linux
• Santoku - A Linux Distro For Mobile Security, Malware Analysis, and Forensics
• SpiderFoot - An Open Source Intelligence Automation Tool
• PacketFence - An Open Source Network Access Control System
• Suricata - An Open Source IDS / IPS / NSM engine
• Malwasm - Tool For Malware Reverse Engineers
• Nishang - PowerShell For Penetration Testing and Offensive Security