EnScript to obtain connected USB devices from System Restore Points (XP)
A reader requested that I modify my original USB information EnScript to work with the snapshot copies of the SYSTEM registry hives that are saved in the System Volume Information folder by the System Restore service in windows XP.
I have modified the original EnScript to only parse the registry hives found in the system Volume Information folder. This is a seperate EnScript and does not parse the active registry hives, only the ones in the System Volume Information Folder.
Download Here
ShareThis
Posts
7 comments:
Mr. Mueller, I am using EnCase version 6.14.3.4 and I was trying to use your provided EnScript - I'm trying to match up an external drive with my suspect computer. Here are the results when using the enscript. Any assistance would be appricated. Regards, Sgt. Robert Salter forensic@cityofrichfield.org or rsalter@cityofrichfield.org.
Error: Reference to null EntryClass object, Specialized Scripts\USB Device History - System Volume Information(53,0)
Name: USB Device History - System Volume Information
Status: Error
Start: 11/01/09 11:18:44AM
Stop: 11/01/09 11:18:45AM
Time: 0:00:01
Hi Lance,
This is David Shin, I worked with you at Guidance. I am trying to run your USB Device History - System Volume Information enpack but I get the following error message in the output tab:
"35880BB8E71ACA4D956E6E303B44FA0B" does not exist, USB Device History - System Volume Information (10,42)
Any feed back would be appreciated. Hope all is well with you.
thank you.
David
HI David,
Some of the reg hives that are collected in the System Volume information are partial hives, meaning they dont have all the keys and values of a regular hive. So it appears that you are running across a hive that does not have some of the keys that are needed to determine or get the USB information.
Here is an updated version to only process selected hives in the System Restore Point. If you have any additional trouble, just email me: lance(at)forensickb.com
http://www.lancemueller.com/blog/USB%20Device%20History%20-%20System%20Volume%20Information%20-%20Selected%20Only.EnPack
Hi Lance , I tried to run the script in a Encase 7.05.02 to get USB device connected in an evidence file and I get this error "C:\Users\XXXX\Documents\EnCase\EnScript\USB Device History - System Volume Information - Selected Only.EnPack (65): "RecordFolderClass" is an unknown identifier"
Do you know why it doesn't know the RecordFolderClass ? Any help will be appreciate.
thanks in advance.
max
Max,
That EnScript is not designed to run in EnCase v7.
Hi Lance,
How can I get the enscript for USB activity for encase 7? Win7 system....
Wei -
http://www.lancemueller.com/blog/USB%20Information_Windows%207.EnPack
http://www.lancemueller.com/blog/Parse%20setupapidev.log%20for%20USB%20info.EnPack
Post a Comment