A tool that reads data stored under USBSTOR key in the system registry hive, representing information about connected USB storage devices. The work is based on Eric Zimmerman's Registry Explorer. The result is presented in tabular format.
- Provides serial number, first insertion, last insertion, and last removal dates.
- Can process live system hive (requires admin privileges).
- Provides GUID, which can be used to identify the user if it was found in the user's NTUser.dat file.
- Export to CSV.
- Development and tests were done on Windows 10 only, so it might not work with other Windows profiles.
- Data about USB connections can be found in several locations other than USBSTOR. For now, this tool only reads USBSTOR.
- The tool uses standard Windows grid from the Windows Forms control suite, so no fancy DevExpress grids or colors (Although might consider using them later).
