usbrip
usbrip is a command-line forensics tool designed for tracking USB device artifacts on Linux systems. The tool analyzes Linux log data to reconstruct USB device connection history and activity. Key capabilities include: - Building comprehensive USB event history tables with detailed device information - Tracking connected and disconnected timestamps for USB devices - Recording vendor ID, product ID, manufacturer details, and serial numbers - Monitoring USB port usage and device assignments - Exporting forensic data in JSON format for further analysis - Generating authorized USB device lists for compliance purposes - Searching for policy violation events and unauthorized device usage The tool operates through a command-line interface and focuses specifically on Linux-based systems for USB forensic analysis. It processes system logs to extract USB-related events and presents the information in structured formats suitable for digital forensic investigations.
FEATURES
EXPLORE BY TAGS
SIMILAR TOOLS
A library to access and parse Windows XML Event Log (EVTX) format, useful for digital forensics and incident response.
A library to access FileVault Drive Encryption (FVDE) encrypted volumes on Mac OS X systems.
A command-line tool for creating hex dumps, converting between binary and human-readable representations, and patching binary files.
Zenduty's platform provides real-time operational health monitoring and incident response orchestration to improve incident response times and build a solid on-call culture.
A library for read-only access to QEMU Copy-On-Write (QCOW) image files, supporting multiple versions and compression formats for digital forensics analysis.
Stegextract is a Bash script that extracts hidden files and strings from images, supporting PNG, JPG, and GIF formats.
A digital artifact extraction framework for extracting data from volatile memory (RAM) samples, providing visibility into the runtime state of a system.
PINNED
A cybersecurity platform that offers vulnerability scanning, Windows Defender and 3rd party AV management, and MFA compliance reporting, among other features.
Proton Pass is a cross-platform password manager that provides encrypted storage, password generation, and security monitoring features with integrated 2FA and dark web monitoring capabilities.
NordVPN is a commercial VPN service that encrypts internet connections and hides IP addresses through a global network of servers, featuring integrated threat protection and multi-device support.
Fractional CISO service that helps B2B companies implement security leadership to win enterprise deals, achieve compliance, and develop strategic security programs.