Difference between revisions of "USBDevice Table"
(Created page with "This represents a <syntaxhighlight lang="SQL"> CREATE TABLE "USBDevice" ( "ID" uuid NOT NULL, "FileID" uuid NOT NULL, "MediaID" uuid NOT NULL, "Offset" bigint...") |
|||
| (2 intermediate revisions by the same user not shown) | |||
| Line 1: | Line 1: | ||
| − | This represents a | + | This represents a [https://en.wikipedia.org/wiki/USB USB] device found in the exploited media. |
| − | < | + | This table holds Universal Serial Bus devices, where they were found and when they were used. |
| − | CREATE TABLE "USBDevice" ( | + | |
| − | + | =SQL= | |
| − | + | <source lang="SQL"> | |
| − | + | CREATE TABLE "USBDevice" | |
| − | + | ( | |
| − | + | "ID" uuid NOT NULL, | |
| − | + | "FileID" uuid NOT NULL, | |
| − | + | "MediaID" uuid NOT NULL, | |
| − | + | "Offset" bigint DEFAULT (-1) NOT NULL, | |
| − | + | "PID" integer DEFAULT 0 NOT NULL, | |
| − | + | "VID" integer DEFAULT 0 NOT NULL, | |
| + | "Revision" smallint DEFAULT 0 NOT NULL, | ||
| + | "USBDeviceTypeID" integer DEFAULT 0 NOT NULL, | ||
| + | "When" timestamp without time zone NOT NULL, | ||
| + | "DeviceID" uuid NOT NULL | ||
); | ); | ||
| − | </ | + | </source> |
| + | |||
| + | =Columns= | ||
| + | ==<code>ID</code>== | ||
| + | The globally unique identifier for this record. | ||
| + | This is also the primary key for this table. | ||
| + | |||
| + | ==<code>FileID</code>== | ||
| + | The globally unique identifier of the file this USB device reference was found. | ||
| + | It corresponds to the <code>[ID]</code> column of the <code><nowiki>[</nowiki>[[File Table|File]]<nowiki>]</nowiki></code> table. | ||
| + | |||
| + | ==<code>MediaID</code>== | ||
| + | The globally unique identifier of the media this USB device was found in. | ||
| + | It corresponds to the <code>[ID]</code> column of the <code><nowiki>[</nowiki>[[Media Table|Media]]<nowiki>]</nowiki></code> table. | ||
| + | |||
| + | ==<code>Offset</code>== | ||
| + | The offset into the file where this USB device was referenced. | ||
| + | If this value is -1, the offset was not known. | ||
| + | |||
| + | ==<code>PID</code>== | ||
| + | The Product ID. | ||
| + | It corresponds to the <code>[PID]</code> column of the <code>[USBPIDVID]</code> table. | ||
| + | |||
| + | ==<code>VID</code>== | ||
| + | Vendor Identifier. | ||
| + | It corresponds to the <code>[VID]</code> column of the <code>[USBPIDVID]</code> table. | ||
| + | |||
| + | ==<code>Revision</code>== | ||
| + | The revision of the device. | ||
| + | |||
| + | ==<code>USBDeviceTypeID</code>== | ||
| + | The type of device this is. | ||
| + | It corresponds to the <code>[ID]</code> column of the <code>[USBDeviceType]</code> table. | ||
| + | |||
| + | ==<code>When</code>== | ||
| + | When the USB device was seen. | ||
| + | The device was connected to the host system at this time. | ||
| + | |||
| + | ==<code>DeviceID</code>== | ||
| + | The globally unique identifier given to the device by Windows. | ||
| + | It does not correspond to any table in Truxton. | ||
Latest revision as of 07:32, 3 February 2024
This represents a USB device found in the exploited media. This table holds Universal Serial Bus devices, where they were found and when they were used.
Contents
SQL
CREATE TABLE "USBDevice"
(
"ID" uuid NOT NULL,
"FileID" uuid NOT NULL,
"MediaID" uuid NOT NULL,
"Offset" bigint DEFAULT (-1) NOT NULL,
"PID" integer DEFAULT 0 NOT NULL,
"VID" integer DEFAULT 0 NOT NULL,
"Revision" smallint DEFAULT 0 NOT NULL,
"USBDeviceTypeID" integer DEFAULT 0 NOT NULL,
"When" timestamp without time zone NOT NULL,
"DeviceID" uuid NOT NULL
);
Columns
ID
The globally unique identifier for this record. This is also the primary key for this table.
FileID
The globally unique identifier of the file this USB device reference was found.
It corresponds to the [ID] column of the [File] table.
MediaID
The globally unique identifier of the media this USB device was found in.
It corresponds to the [ID] column of the [Media] table.
Offset
The offset into the file where this USB device was referenced. If this value is -1, the offset was not known.
PID
The Product ID.
It corresponds to the [PID] column of the [USBPIDVID] table.
VID
Vendor Identifier.
It corresponds to the [VID] column of the [USBPIDVID] table.
Revision
The revision of the device.
USBDeviceTypeID
The type of device this is.
It corresponds to the [ID] column of the [USBDeviceType] table.
When
When the USB device was seen. The device was connected to the host system at this time.
DeviceID
The globally unique identifier given to the device by Windows. It does not correspond to any table in Truxton.
