Nothing noteworthy in the shellbags.
I'm just curious…what tool did you use to parse and present this information?
I used RegRipper and the NTUSER plugin.
Meanwhile , thanks for the suggestions !
I don't have any access to the network share but I'm in close contact with the IT guy from our contractor.
I'm going to ask him if he has logging enabled.
There is breakthrough however as I went back and went through the USB devices again and it looks like I missed one the last time around oops What does it mean that it doesn't have a VID or PID ? This is the output of the USBDeviceForensics tool
Vendor Ven_USB
Product Prod_Flash_Disk
Version Rev_2.00
Serial No 6&15f7d341&0
VID
PID
ParentIdPrefix 7&1c442b92&0
Drive Letter
Volume Name
GUID 7beb28c6-cab2-11de-a4c6-028037ec0200
MountPoint STORAGE#RemovableMedia#7&1c442b92&0&RM#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Install Date/Time
First Time Connected After Last Reboot (DeviceClasses Date/Time) friday june 15 2012 072307 Z (UTC)
First Time Connected After Last Reboot (Enum\USB VIDPID Date/Time) monday january 1 0001 000000 Z (UTC)
Last Time Connected (MountPoints2 Date/Time) friday june 15 2012 072329 Z (UTC) (File NTUSER.DAT)
I'm just curious…what tool did you use to parse and present this information?
I used RegRipper and the NTUSER plugin.
I don't follow. RegRipper doesn't have a "NTUSER" plugin, per se….there's an NTUSER profile which contains a list of plugins to be run against the NTUSER.DAT hive. So, I'd be interested to know which plugin, specifically, you used to retrieve the shellbag information from the NTUSER.DAT…that will be helpful to know.
What does it mean that it doesn't have a VID or PID ?
I'm not really sure that's the question to be asking. I'd suggest that it might be better to understand where the tool is getting it's data…that might more directly address the issue. I think that a specific device not having a VID or PID value isn't so much the issue, because it really depends on how the tool you're using populates that data. There's enough information in that tool output that you could go through the Registry hives and determine everything you need to know to close the loop on that analysis.
The shellbag plugin for Regripper doesn't parse shellbags from XP (NTuser.dat). Only bag information from usrclass.dat (i.e. vista and higher).
You are right. I have not looked at the shellbags. Will do that now !