How to use the USB Device History Analyzer agent skill

What is an agent skill and what does this one do?

An agent skill is a folder containing a SKILL.md file and optional scripts and reference documents. When the skill is installed, the agent can load these instructions when a request matches the skill's description, so it follows a documented workflow instead of improvising.

This skill correlates three kinds of Windows artifacts: the USBSTOR and MountedDevices registry keys, Windows Event Logs, and the setupapi.dev.log file. Together they let the agent work out first and last connection timestamps for each device and the drive letters assigned to them.

• Copy registry hives (SYSTEM, SOFTWARE, NTUSER.DAT) and logs out of a mounted forensic image
• Parse the USBSTOR key to list device vendor, product, revision, serial and friendly name
• Parse MountedDevices to map drive letters to USB devices or fixed disks
• Read MountPoints2 in NTUSER.DAT to see which user accessed which volumes
• Match setupapi.dev.log install entries and event log records to build a timeline

How do you install the USB Device History Analyzer skill?

Download the ZIP file from this page and unzip it. You can install the skill in one of two places. For a personal setup for all your projects, unzip it into ~/.claude/skills/ so the folder analyzing-usb-device-connection-history sits inside that directory. For a single project, unzip it into the project's .claude/skills/ folder instead.

If you use the Claude apps rather than a local setup, you can upload the skill instead. Go to Settings, then Capabilities, then Skills, and upload the skill there.

• Personal install: ~/.claude/skills/analyzing-usb-device-connection-history/
• Project install: .claude/skills/analyzing-usb-device-connection-history/ inside your project
• Claude apps: Settings → Capabilities → Skills → upload

What do you need before you start?

The skill assumes you already have forensic evidence. It does not create images or collect artifacts from a live machine. You need a forensic image or already-extracted registry hives and event logs from a Windows system, and you need Python 3 with the regipy Python library, which scripts/agent.py uses.

You also need a working knowledge of USB identifiers such as vendor ID, product ID and serial number. The source names optional tools you may use alongside the skill: USBDeview, USB Forensic Tracker and RegRipper.

• Python 3
• regipy Python library (used by scripts/agent.py)
• SYSTEM, SOFTWARE and NTUSER.DAT hives, from a forensic image or extracted copies
• setupapi.dev.log and Windows event log files such as System.evtx
• Optional: USBDeview, USB Forensic Tracker or RegRipper

How do you trigger the skill with a natural request?

You do not need special syntax. Describe the investigation in plain language and mention the artifacts you have. The agent should match the request to the skill's description, which covers removable media usage, device provenance and timelines for suspected data exfiltration.

Be specific about the case: say what evidence folder you have, whether you are working from a disk image or extracted hives, and what question you need answered. Include the time window if you have one.

• "Using the extracted SYSTEM and NTUSER.DAT hives in my case folder, list every USB storage device and when each was first and last connected."
• "Map the drive letters in MountedDevices to USB devices and tell me which were removable media."
• "Build a timeline from setupapi.dev.log and the System event log for suspected data exfiltration on this workstation."
• "Check which user accounts accessed each USB volume using MountPoints2."

What does a typical workflow look like?

The source workflow has four steps. First, mount a forensic image read-only and copy the relevant hives and logs into a separate case folder. Second, parse the USBSTOR key in the SYSTEM hive, using the active ControlSet from the Select key. Third, read MountedDevices and the per-user MountPoints2 keys. Fourth, extract install timestamps from setupapi.dev.log and event IDs from the event logs, then compare them with the registry results.

Expect the agent to write results such as a usb_devices.json file in the analysis folder. Review every timestamp yourself, because the source notes that registry key timestamps reflect last write times and need correlating with other artifacts.

What safety and privacy points should you know?

This skill runs scripts. The SKILL.md workflow and the bundled scripts/agent.py read sensitive registry data, including user activity and device history. The skill does not use the network, according to its listing. Only examine systems you are authorised to investigate.

The skill is for analysing artifacts after the fact. It does not monitor or block USB devices, and it targets Windows artifacts only, so it will not help with Linux or macOS systems. Mount evidence read-only, as the source example does with the ro option, to avoid altering it.

• Use only on systems you have authorisation to examine
• Mount images read-only (the source uses mount -o ro)
• Review the scripts before running them on evidence
• Keep your case folder separate from the original image

What tips help you get reliable results?

Treat registry key last-write times as evidence to corroborate, not as proof on their own. Cross-check the setupapi.dev.log install times, the event log records and the MountedDevices entries before drawing conclusions. Note the ControlSet the skill selects from the Select key so your results are reproducible.

If a file is missing, such as the DriverFrameworks-UserMode event log, the source copies those files with error suppression, so check which artifacts actually exist in your image before building a timeline.

• Corroborate every timestamp with a second artifact
• Record which ControlSet and hive files you used
• Keep the original evidence unchanged and work on copies
• Document each step for your case notes