USBDevices icon indicating copy to clipboard operation
USBDevices copied to clipboard

SystemHiveInfo.cs retrieves only one Serial Number from USB hive (Line 89 of code)

Open qasali opened this issue 7 years ago • 0 comments

In USB Forensics, \ControlSet001\Enum\USB hive keeps the information of all USB devices. if you see line 5 to 8 of a SYSTEM registry hive loaded in image https://preview.ibb.co/j9UkwK/Screenshot_USB_and_USBSTOR_hive.png you will see that different USB devices of same Vendor and Product ID has been plugged into the computer. However the code in SystemHiveInfo,cs (line 89) retrieves only the 1st serial number. For example while using the API i only retrieve USB information at (LINE 6) of image. Whereas it should retrieve the other two serial numbers as well (line 7 and 8)

Will you please look into this issue.

qasali avatar Aug 03 '18 03:08 qasali