PSGetModuleInfo.xml
|
<Objs Version="1.1.0.1" xmlns="http://schemas.microsoft.com/powershell/2004/04">
<Obj RefId="0"> <TN RefId="0"> <T>Microsoft.PowerShell.Commands.PSGetModuleInfo</T> <T>System.Management.Automation.PSCustomObject</T> <T>System.Object</T> </TN> <MS> <S N="Name">USBDeviceHistory</S> <Version N="Version">1.0</Version> <S N="Description">This module scrapes a series of registry keys for information about USB devices that have been inserted into the computer. In addition, the System EventLog is queried for EventIDs 20003 and 20001. _x000D__x000A__x000D__x000A_The resulting information can be saved to reports in $HOME\Desktop\Get-USBHistory_Out\ (using the -OutputToReport parameter), displayed on the console (using the -OutputToConsole parameter), or both._x000D__x000A__x000D__x000A_The following registry keys are queried:_x000D__x000A__x000D__x000A_hklm:\system\currentcontrolset\enum\usb\*\* _x000D__x000A_hklm:\system\mounteddevices\_x000D__x000A_hkcu:\software\microsoft\windows\currentversion\explorer\mountpoints2_x000D__x000A_hklm:\software\microsoft\windows\currentversion\setup\pnpresources\registry\_x000D__x000A_hklm\system\currentcontrolset\control\usbstor_x000D__x000A_hklm:\software\microsoft\windows nt\currentversion\emdmgmt_x000D__x000A_hklm:\software\microsoft\windows portable devices\devices_x000D__x000A_hklm:\system\controlset001\control\devicemigration\devices\usb_x000D__x000A_hklm:\system\controlset001\control\devicemigration\devices\usbstor_x000D__x000A_</S> <S N="Author">Vasken Houdoverdov</S> <Obj N="CompanyName" RefId="1"> <TN RefId="1"> <T>System.Management.Automation.PSCustomObject</T> <T>System.Object</T> </TN> </Obj> <S N="Copyright">(c) 2015 Vasken Houdoverdov. All rights reserved.</S> <DT N="PublishedDate">2015-06-22T16:17:36-07:00</DT> <Nil N="LicenseUri" /> <Nil N="ProjectUri" /> <Nil N="IconUri" /> <Obj N="Tags" RefId="2"> <TN RefId="2"> <T>System.Object[]</T> <T>System.Array</T> <T>System.Object</T> </TN> <LST> <S>PSModule</S> <S>usb</S> <S>device</S> <S>hardware</S> <S>removable</S> <S>registry</S> <S>eventlog</S> <S>forensics</S> <S>enum</S> <S>query</S> <S>PSIncludes_Cmdlet</S> </LST> </Obj> <Obj N="Includes" RefId="3"> <TN RefId="3"> <T>System.Collections.Hashtable</T> <T>System.Object</T> </TN> <DCT> <En> <S N="Key">Function</S> <Obj N="Value" RefId="4"> <TNRef RefId="2" /> <LST /> </Obj> </En> <En> <S N="Key">DscResource</S> <Obj N="Value" RefId="5"> <TNRef RefId="2" /> <LST /> </Obj> </En> <En> <S N="Key">Cmdlet</S> <Obj N="Value" RefId="6"> <TNRef RefId="2" /> <LST> <S>Get-USBDeviceHistory</S> </LST> </Obj> </En> <En> <S N="Key">Command</S> <Obj N="Value" RefId="7"> <TNRef RefId="2" /> <LST> <S>Get-USBDeviceHistory</S> </LST> </Obj> </En> </DCT> </Obj> <Nil N="PowerShellGetFormatVersion" /> <Nil N="ReleaseNotes" /> <Obj N="Dependencies" RefId="8"> <TNRef RefId="2" /> <LST /> </Obj> <S N="RepositorySourceLocation">https://www.powershellgallery.com/api/v2/</S> <S N="Repository">PSGallery</S> <S N="PackageManagementProvider">NuGet</S> </MS> </Obj> </Objs> |