USBDeviceHistory
1.0.1
This module scrapes a series of registry keys for information about USB devices that have been inserted into the computer. In addition, the System EventLog is queried for EventIDs 20003 and 20001.
The resulting data can be saved to HTML tables in $home\Desktop\Get-USBHistory_Out with the -OutputToReport parameter. Additionally, it can be displayed
The resulting data can be saved to HTML tables in $home\Desktop\Get-USBHistory_Out with the -OutputToReport parameter. Additionally, it can be displayed
This module scrapes a series of registry keys for information about USB devices that have been inserted into the computer. In addition, the System EventLog is queried for EventIDs 20003 and 20001.
The resulting data can be saved to HTML tables in $home\Desktop\Get-USBHistory_Out with the -OutputToReport parameter. Additionally, it can be displayed on the console with the -OutputToConsole parameter.
The following registry keys are queried:
hklm:\system\currentcontrolset\enum\usb\*\*
hklm:\system\mounteddevices\
hkcu:\software\microsoft\windows\currentversion\explorer\mountpoints2
hklm:\software\microsoft\windows\currentversion\setup\pnpresources\registry\
hklm\system\currentcontrolset\control\usbstor
hklm:\software\microsoft\windows nt\currentversion\emdmgmt
hklm:\software\microsoft\windows portable devices\devices
hklm:\system\controlset001\control\devicemigration\devices\usb
hklm:\system\controlset001\control\devicemigration\devices\usbstor
Show more
The resulting data can be saved to HTML tables in $home\Desktop\Get-USBHistory_Out with the -OutputToReport parameter. Additionally, it can be displayed on the console with the -OutputToConsole parameter.
The following registry keys are queried:
hklm:\system\currentcontrolset\enum\usb\*\*
hklm:\system\mounteddevices\
hkcu:\software\microsoft\windows\currentversion\explorer\mountpoints2
hklm:\software\microsoft\windows\currentversion\setup\pnpresources\registry\
hklm\system\currentcontrolset\control\usbstor
hklm:\software\microsoft\windows nt\currentversion\emdmgmt
hklm:\software\microsoft\windows portable devices\devices
hklm:\system\controlset001\control\devicemigration\devices\usb
hklm:\system\controlset001\control\devicemigration\devices\usbstor
The owner has unlisted this package.
This could mean that the module is deprecated or shouldn't be used anymore.
Installation Options
Owners
Copyright
(c) 2015 Vasken Houdoverdov. All rights reserved.
Package Details
Author(s)
- Vasken Houdoverdov
Tags
usb device hardware removable registry eventlog forensics enum query
Cmdlets
Dependencies
This module has no dependencies.
FileList
- USBDeviceHistory.nuspec
- PSGetModuleInfo.xml
- USBDeviceHistory.psd1
- USBDeviceHistory.psm1
Version History
Version | Downloads | Last updated |
---|