USB devices can be a convenience and a curse.

Devices that plug into the USB ports on a computer are convenient to use, but they can be a security headache, too. What security-conscious system administrator hasn’t contemplated the grim consequences of gigabytes of sensitive data inappropriately stored on a thumb drive walking out the front door of his or her company in the shirt pocket or purse of an employee? What security specialist hasn’t cringed at the thought of a compromised USB device being plugged into his or her network where it can infect the system with a virus, Trojan or worm?

One way to identify problems associated with USB devices is to follow their leavings. Among the leavings left behind by USB devices when they’re attached to a computer running Windows are their serial numbers. Although not all USB devices have serial numbers, most do, and they can be used to perform some basic computer forensics, as Adrian Crenshaw pointed out in a recent posting in his Irongeek.com blog.

For example, if the ownership of a USB drive linked to malicious activity is in a dispute, a scan of the suspects’ computers would reveal which one the device had been connected to. Chances are the operator of the computer containing the serial number of the device in its Windows registry will be the culprit in the case.

If the source of a virus is linked to a USB device, comparing the serial numbers of the devices connected to the system at the time the infection began to spread could help identify the compromised hardware and even identify the point of initial infection.

In another scenario, a serial number belonging to a suspicious device–a digital media player, for instance–might show up in the registry for a Windows server. By scrutinizing the registries of the PCs on the system for the serial number of the device, its owner can be identified and appropriate action taken.

Crenshaw identifies two registry keys where USB information is stored.

1. The key storing information on USB devices that are connected to a system or have been connected to a system is HKEY_LOCAL_MACHINESYSTEMCurrentControlSetEnumUSB.
2. Another key–HKEY_LOCAL_MACHINESYSTEMCurrentControlSetEnumUSBSTOR–stores information strictly on USB storage devices. While the USB key may be scrubbed by programs like CleanAfterMe, the USBSTOR key may survive such purges.

As anyone who’s opened up a Windows registry knows, finding what’s wanted can be challenging. When it comes to the serial numbers of USB devices, the task can be less challenging with a free tool recommended by Crenshaw called USBDeview by NirSoft. The application displays information from the USB registry keys in an easy to peruse table format that can sorted by column. Columns contain information such as Device name/description, device type, serial number, date/time that device was added, VendorID, ProductID and such.

What’s nice about USBDeview is that it allows you to  grab USB information from any machine on your network. Of course, administrator privileges are needed to tap into that data. “Even if you have the admin user name and password of the remote machine that you wish to connect to, you still have to configure it properly in order to get full  administrator access,” NirSoft explains at its Web site. “If you have a network with a domain controller, and you are the administrator of this domain, your life is a little easier, because some configuration changes required to get admin access remotely are made by Windows automatically when the computer joins the domain.”

The program will also trawl multiple computers on a network for USB information. You can do that by setting up a text file with the computers you want scanned listed by name or IP address in UNC format. When the information is returned and displayed in USBDeview’s familiar table format, you can use the column feature to analyze it. Need to identify the PCs on the system that are using or have used a particular device? Click on the serial number column and check out the rows with the hardware’s serial number in them.

If you have many computers on your network, the amount of information gathered by the program can overwhelm the table format. NirSoft addresses that prospect by allowing information from the table to be exported in a number of file formats, including CSV. A CSV file can easily be imported into a database program where more precise analysis of the table’s data can be performed.

While this kind of analysis may not appeal to all administrators, those with an interest in forensic computing may find the process worth experimenting with.