usbrip is a forensic tool with a command-line interface that tracks artifacts left by USB devices. It is written in Python3.
It analyzes logs to build event tables, which may contain the following information: date and time of device connection, user, vendor ID, product ID, and more.
In addition, the tool can do the following:
- export collected information as a JSON dump;
- generate a list of authorized (trusted) USB devices in JSON format;
- detect suspicious events related to devices not on the list of authorized devices;
- create encrypted stores (7zip archives) for automatic backups (this is possible when installed with the -s flag);
- search for additional information about a specific USB device by its VID and/or PID.
Source: linux.org.ru
