{"id":26277711,"url":"https://github.com/nannib/usbnlnk","last_synced_at":"2025-06-12T02:03:45.016Z","repository":{"id":216839913,"uuid":"742526920","full_name":"nannib/USBnLnk","owner":"nannib","description":"This program can correlate the dates of USB mass device connections with recent files and export a report in CSV format","archived":false,"fork":false,"pushed_at":"2024-02-25T11:23:37.000Z","size":224,"stargazers_count":3,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2024-02-25T12:30:09.688Z","etag":null,"topics":["correlation","dfir","digital-forensics","forensics","free","lnk","lnk-files","lnks","open","open-source","opensource","python","recent-files","tool","usb","usb-forensics"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/nannib.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null}},"created_at":"2024-01-12T17:18:07.000Z","updated_at":"2024-02-25T11:20:27.000Z","dependencies_parsed_at":"2024-02-04T10:34:51.188Z","dependency_job_id":"188b17bb-3525-4cd6-8e3e-023689300eb0","html_url":"https://github.com/nannib/USBnLnk","commit_stats":null,"previous_names":["nannib/usbnlnk"],"tags_count":1,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nannib%2FUSBnLnk","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nannib%2FUSBnLnk/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nannib%2FUSBnLnk/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/nannib%2FUSBnLnk/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/nannib","download_url":"https://codeload.github.com/nannib/USBnLnk/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":243573442,"owners_count":20312883,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["correlation","dfir","digital-forensics","forensics","free","lnk","lnk-files","lnks","open","open-source","opensource","python","recent-files","tool","usb","usb-forensics"],"created_at":"2025-03-14T12:21:03.507Z","updated_at":"2025-03-14T12:21:04.106Z","avatar_url":"https://github.com/nannib.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# USBnLnk\nThis tool can correlate the dates of USB mass device connections with recent files and  export a report in CSV format\n\nIt runs on Windows 8,10,11 - tested with Python 3.8.6\n\nThis program export the Windows key: [HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Enum\\USBSTOR]\nvia NIRCMD.EXE (https://www.nirsoft.net/utils/nircmd.html) nircmd.exe elevatecmd runassystem reg export \"HKLM\\\\SYSTEM\\\\ControlSet001\\\\Enum\\\\USBSTOR\" {usbstor_txt_path} to elevate privileges to the SYSTEM user, which is the only one user that can access to the subkey:[HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Enum\\USBSTOR\\\u003cdevice\u003e\\\u003cSerialNumber\u003e\\Properties\\\\{83da6326-97a6-4088-9453-a1923f573b29}\\0066] where is the last connection timestamp of the USB MASS DEVICE. (https://www.nirsoft.net/utils/usb_devices_view.html)\n\nNIRCMD LICENSE: This utility is released as freeware. You are allowed to freely distribute this utility via floppy disk, CD-ROM, Internet, or in any other way, as long as you don't charge anything for this. If you distribute this utility, you must include all files in the distribution package, without any modification!\n\nNIRCMD.EXE: SHA256: B994AE5CBFB5AD308656E9A8BF7A4A866FDEB9E23699F89F048D7F92E6BB8577\n\nNIRCMD.ZIP: SHA256: 5071B54669BB1E88422C6C340204B0B3A0FFD07E2AC1D747CCBD1447ABC92948\n\n**How to RUN**\n\npip install -r requirements.txt\n\npython main.py\n\nit creates the report and the two CSV files (list of usb devices and list of recent files) in the same directory of the program.\n\nYou can create an **EXEcutable** file for Windows using this command::\n\n **pyinstaller --clean --hidden-import babel.numbers --onefile --add-binary nircmd.exe;. --add-data nb_usb.py;. --add-data lnkfile.py;. main.py**\n\n![image](https://github.com/nannib/USBnLnk/assets/12171140/ff2aed33-77be-4748-a8d4-16de5c8c2134)\n\n\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnannib%2Fusbnlnk","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fnannib%2Fusbnlnk","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fnannib%2Fusbnlnk/lists"}