665,000+ skills indexed

AxxxxxxaaannCOMMUNITY

Explore all skills by this author →

Verified:GitHub

analyzing-usb-device-connection-history

Parse Windows registry and logs to generate a unified USB device timeline.

Updated Aug 23, 2026

Search Tags:#timeline #usb #incident-response #data-exfiltration #usb-forensics #registry-analysis

One-click install

npx skills add https://github.com/Axxxxxxaaann/KAIRI-Skills --skill analyzing-usb-device-connection-history

Or copy as Structured Prompt for Agent▼

Please help me install this Agent Skill.
Skill: analyzing-usb-device-connection-history
Source: https://github.com/Axxxxxxaaann/KAIRI-Skills/tree/main/skills/analyzing-usb-device-connection-history
Command: npx skills add https://github.com/Axxxxxxaaann/KAIRI-Skills --skill analyzing-usb-device-connection-history

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires regipy, and includes scripts (resource) and references (resource) components.

What problem does it solve?

Analyzing USB device connection history to detect removable media usage patterns, insider threats, and potential data exfiltration across Windows endpoints.

Core Features & Use Cases

Parse USBSTOR registry data to enumerate vendor, product, serials, and last-connected timestamps.
Correlate with MountedDevices and MountPoints2 to map drive letters and user access to USB devices.
Leverage SetupAPI logs and Windows event logs to build a comprehensive USB activity timeline for incident response and audits.

Quick Start

Run the agent with the SYSTEM hive path, NTUSER.DAT, and setupapi.dev.log to generate a unified usb_timeline.csv.

Frequently Asked Questions about analyzing-usb-device-connection-history

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I trace USB device connection history for an incident response investigation?▼

Build a USB activity timeline by parsing USBSTOR registry data, MountPoints2, and SetupAPI logs. This correlates device serials, drive letters, and user access to identify removable media usage and potential data exfiltration.

What Windows registry keys are needed to map USB drive letters to user accounts?▼

Mapping drive letters to user access requires parsing USBSTOR, MountedDevices, and MountPoints2 registry keys. Correlating these artifacts from NTUSER.DAT and SYSTEM hives reveals which user mounted a specific removable device.

Can I use setupapi.dev.log to build a timeline of removable media connections?▼

Yes, setupapi.dev.log records device installation timestamps useful for building a USB activity timeline. Combined with Windows event logs and registry data, it reveals when removable storage devices were connected to the endpoint.

Does this USB forensics approach work for insider threat investigations across Windows endpoints?▼

Yes, this approach applies to insider threat investigations across Windows endpoints. It parses registry hives and SetupAPI logs to enumerate vendor, product, serials, and last-connected timestamps to detect unauthorized removable media usage.

Do I need regipy to parse registry hives for USB device metadata?▼

Yes, regipy is required to parse registry hives for USB device metadata. It extracts artifacts from the SYSTEM hive and NTUSER.DAT to enumerate USBSTOR entries, device serials, and last-connected timestamps for forensic timeline analysis.

What is the best way to generate a unified timeline of USB storage device usage?▼

Generate a unified USB storage timeline by parsing USBSTOR, MountedDevices, MountPoints2, SetupAPI logs, and Windows event logs together. This produces a CSV with device metadata and connection timestamps for compliance audits.

Related Skills

Explore More Data & Analytics Skills→

registry-forensics

Parse Windows Registry hives to extract artifacts and generate timelines.

postgresql-log-analyzer

Analyzes Patroni and PostgreSQL logs to identify and correlate error patterns across Kubernetes clusters.

performing-log-analysis-for-forensic-investigation

Collect, parse, and correlate Windows EVTX, Linux syslog, and web access logs into a unified forensic timeline.

timeline-forensics

Aggregate disk, memory, log, PCAP, and registry artifacts into forensic timelines.