USB Detective

Thorough Detection

USB Detective incorporates dozens of data points in identifying and correlating USB device artifacts.

Intelligent Investigation

USB Detective organizes its findings to allow you to quickly identify misleading timestamps and streamline the investigation process.

Pragmatic Reporting

Multiple reporting mechanisms allow for easily-digested Excel reports or verbose reports for deeper analysis and research.

 Purchase USB Detective Professional Download USB Detective Community

USB Detective is an application for identifying, investigating, and reporting on USB storage devices that have been connected to a Windows system.  Using its consistency level color-coding, USB Detective gives you the ability to quickly distinguish attributes with corroborating data sources from those with potentially misleading or inaccurate timestamps.  USB Detective’s findings are organized to allow for a high-level view of USB device activity using the results grid as well as a more in-depth examination using the verbose view.

Highlighted Features

  • Visually represented timestamp consistency levels
  • Dozens of sources queried for USB device information
  • Source of every identified value preserved for later reporting and documentation
  • Correlation using multiple data points (device serial, container ID, etc.)
  • Queried data points adjusted based on automatic OS version detection
  • Identify devices even after they’re removed via Windows 10 device cleanup
  • Support for Windows versions from XP through Windows 10
  • Support for multiple versions of all accepted artifacts
  • USB Detective Results Grid

Additional Features

  • Create Excel spreadsheets for high-level USB device history reports
  • Create verbose reports for deeper analysis and research
  • Identify device removal date/time from device cleanup in Windows 10
  • Search mounted forensic image instead of individual files/folders
  • Automatic detection of system timezone
  • Normalize local and UTC timestamps using system timezone
  • Display timestamps in 12-hour or 24-hour format
  • Alerts for suspicious timestamps
  • Advanced correlation for Apple devices
  • Identify prior volume names and serial numbers for formatted devices
  • Settings from prior session automatically reloaded
  • Search all control sets of all provided SYSTEM hives
  • Adjust consistency level threshold
  • And much more…

Enterprise and academic licenses are also available.  For more information, submit a request using the Contact page.

 Purchase USB Detective Professional Download USB Detective Community