EMDMGMT query

Cults14 · 2014-08-13T21:30:42Z

Query on EMDMGMTI'm looking at a system where a device is listed in EMDMGMT, parsed using Harlan's emdmgmt v.20120207 it looks like thisUserName VPC LastWrite Thu Nov 21 015917 2013 Z VSN E09B-7A77 LastTestedTime Thu Nov 21 015917 2013 ZWhere UserName happens to be the user's last nameThe key isSOFTWAREMicrosoftWindows NTCurrentVersionEMDMgmtVAG___UserName VPC_3768285815"VAG", "VPC" and "3768285815" don't turn up anywhere else in the Registry (as keys at least), and don't appear in any other USB artefacts that I've parsed so far, in RegRipper have used theseusbstor v.20080418usbdevices v.20120522mountdev2 v.20120403mp2 v.20120330emdmgmt v.20120207removdev v.200800611devclass v.20130630It also doesn't appear in setupapi.dev.logIt's unsettling as the device appears when I parse LNK files and Jumplists, with Mod dates ranging from 22nd March 2014 to 21st May 2014The user is no longer with the company, having joined a competitor. Can anyone suggest why this might be happening? The user had Virtual Box installed on his Win7 Enterprise SP1 system, I have no experience with this (and very little with Virtual Machines in general), but as I don't have his network login password I beleive I can't build a VM using LiveView?Cheers

Page 3 / 3 Prev

General (Technical, Procedural, Software, Hardware etc.)

Last Post by Jonathan 12 years ago

21 Posts

4 Users

0 Reactions

4,797 Views

RSS

Jonathan

(@jonathan)

Prominent Member

Joined: 21 years ago

Posts: 878

19/08/2014 1:35 pm

Not adding to this topic, apart from saying that I find keydet89's input here (particularity the first post) to be exceptional. Well reasoned, referenced, helpful. Thank you Harlan.

ReplyQuote

Page 3 / 3 Prev