USB Device History Analyzer
Reconstructs USB storage device connection history from Windows registry, event logs and setup logs.
- Repository
- mukul975/Anthropic-Cybersecurity-Skills
- Stars
- 35,430
- Licence
- Apache-2.0
- Files
- 3 files
What it does
When installed, the agent helps a digital forensics investigator piece together which USB storage devices were plugged into a Windows computer, when they were first and last connected, and which drive letters they were given. It guides the investigator through copying registry hives and logs from a disk image, parsing the USBSTOR and MountedDevices registry keys, and matching the results against setupapi.dev.log and Event Logs to build a timeline, which can support data-exfiltration or insider-threat investigations.
Great for
- Digital forensics and incident response analysts examining removable media on a Windows system
- Security teams building a timeline during an insider threat or data-loss investigation
- Compliance staff checking whether removable media policies were followed
Skip it if
- Live monitoring or blocking of USB devices, since it only analyses artifacts after the fact
- Use on systems you do not have authorisation to examine, because it reads sensitive personal and registry data
- Non-Windows systems, since the artifacts it parses are Windows-specific
Try asking
- “Analyze the SYSTEM and NTUSER.DAT hives from this disk image and list every USB storage device with its serial number and first and last connection times”
- “Map the drive letters assigned to USB devices in the MountedDevices key and show which user accessed them”
- “Correlate setupapi.dev.log install entries with USBSTOR records to build a USB timeline for case 2024-001”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 3 original files, the Apache-2.0 licence and an attribution note.
analyzing-usb-device-connection-history.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip analyzing-usb-device-connection-history.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip analyzing-usb-device-connection-history.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Work on a read-only copy of the evidence and keep the original image untouched, as the guide's mount commands suggest
- Treat registry key timestamps as last-write times, not proof of the first connection; cross-check with setupapi.dev.log and event logs
- Have a qualified examiner review findings before using them in legal or HR proceedings
What's inside
- references/api-reference.md
- scripts/agent.py
- SKILL.md
Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.