USBDeviceHistory

1.0.1

This module scrapes a series of registry keys for information about USB devices that have been inserted into the computer. In addition, the System EventLog is queried for EventIDs 20003 and 20001.

The resulting data can be saved to HTML tables in $home\Desktop\Get-USBHistory_Out with the                  -OutputToReport parameter.  Additionally, it can be displayed
This module scrapes a series of registry keys for information about USB devices that have been inserted into the computer. In addition, the System EventLog is queried for EventIDs 20003 and 20001.

The resulting data can be saved to HTML tables in $home\Desktop\Get-USBHistory_Out with the                  -OutputToReport parameter.  Additionally, it can be displayed on the console with the -OutputToConsole parameter.

The following registry keys are queried:

hklm:\system\currentcontrolset\enum\usb\*\*

hklm:\system\mounteddevices\

hkcu:\software\microsoft\windows\currentversion\explorer\mountpoints2

hklm:\software\microsoft\windows\currentversion\setup\pnpresources\registry\

hklm\system\currentcontrolset\control\usbstor

hklm:\software\microsoft\windows nt\currentversion\emdmgmt

hklm:\software\microsoft\windows portable devices\devices

hklm:\system\controlset001\control\devicemigration\devices\usb

hklm:\system\controlset001\control\devicemigration\devices\usbstor
Show more
The owner has unlisted this package. This could mean that the module is deprecated or shouldn't be used anymore.

Installation Options

Copy and Paste the following command to install this package using PowerShellGet More Info

Install-Module -Name USBDeviceHistory -RequiredVersion 1.0.1

Copy and Paste the following command to install this package using Microsoft.PowerShell.PSResourceGet More Info

Install-PSResource -Name USBDeviceHistory -Version 1.0.1

You can deploy this package directly to Azure Automation. Note that deploying packages with dependencies will deploy all the dependencies to Azure Automation. Learn More

Manually download the .nupkg file to your system's default download location. Note that the file won't be unpacked, and won't include any dependencies. Learn More

Owners

Copyright

(c) 2015 Vasken Houdoverdov. All rights reserved.

Package Details

Author(s)

  • Vasken Houdoverdov

Tags

usb device hardware removable registry eventlog forensics enum query

Cmdlets

Get-USBDeviceHistory

Dependencies

This module has no dependencies.

FileList

Version History

Version Downloads Last updated