usbrip – forensic tool with a command-line interface that monitors artifacts left by USB devices. It is written in Python3.
Analyzes logs to create event tables which may contain the following information: the date and time of device connection, user, vendor ID, product ID, and more.
In addition, the tool can do the following:
- export the collected information as a JSON dump;
- generate a list of authorized (trusted) USB devices in JSON format;
- detect suspicious events related to devices not in the list of authorized devices;
- create encrypted storage (7zip archives) for automatic backup (possible when installed with the -s flag);
- search for additional information about a specific USB device by its VID and/or PID.
Allikas: linux.org.ru
