EricZimmerman / EricZimmerman/USBDevices
SystemHiveInfo.cs retrieves only one Serial Number from USBSTOR hive (Line 355 of code)
- Dominant language
- C#
- Stars
- 22
- Forks
- 8
- PR merge metrics
- No merged PRs in 30d
Description
In USB Forensics, \\ControlSet001\Enum\USBSTOR hive keeps the information of all USB storage devices. if you see line 10 to 13 of a SYSTEM registry hive loaded in image [https://preview.ibb.co/j9UkwK/Screenshot_USB_and_USBSTOR_hive.png](url) you will see that different USB devices of same Vendor and Product ID has been plugged into the computer. However the code in SystemHiveInfo,cs (line 355) retrieves only the 1st serial number. For example while using the API i only retrieve USB Serial Number 7AF6..... (LINE 11) of image. Whereas it should retrieve the other two serial numbers as well (line 12 and 13)
Will you please look into this issue.
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.