Difference between revisions of "USBDevice Table"
| Line 21: | Line 21: | ||
=Columns= | =Columns= | ||
==<code>ID</code>== | ==<code>ID</code>== | ||
| − | The globally unique identifier for this record. This is also the primary key for this table. | + | The globally unique identifier for this record. |
| + | This is also the primary key for this table. | ||
==<code>FileID</code>== | ==<code>FileID</code>== | ||
| Line 29: | Line 30: | ||
==<code>MediaID</code>== | ==<code>MediaID</code>== | ||
The globally unique identifier of the media this USB device was found in. | The globally unique identifier of the media this USB device was found in. | ||
| − | It corresponds to the <code>[ID]</code> column of the <code>[Media]</code> table. | + | It corresponds to the <code>[ID]</code> column of the <code><nowiki>[</nowiki>[[Media Table|Media]]<nowiki>]</nowiki></code> table. |
==<code>Offset</code>== | ==<code>Offset</code>== | ||
| − | The offset into the file where this USB device was referenced. If this value is -1, the offset was not known. | + | The offset into the file where this USB device was referenced. |
| + | If this value is -1, the offset was not known. | ||
==<code>PID</code>== | ==<code>PID</code>== | ||
| − | The Product ID. It corresponds to the <code>[PID]</code> column of the <code>[USBPIDVID]</code> table. | + | The Product ID. |
| + | It corresponds to the <code>[PID]</code> column of the <code>[USBPIDVID]</code> table. | ||
==<code>VID</code>== | ==<code>VID</code>== | ||
| − | Vendor Identifier. It corresponds to the <code>[VID]</code> column of the <code>[USBPIDVID]</code> table. | + | Vendor Identifier. |
| + | It corresponds to the <code>[VID]</code> column of the <code>[USBPIDVID]</code> table. | ||
==<code>Revision</code>== | ==<code>Revision</code>== | ||
| Line 48: | Line 52: | ||
==<code>When</code>== | ==<code>When</code>== | ||
| − | When the USB device was seen. The device was connected to the host system at this time. | + | When the USB device was seen. |
| + | The device was connected to the host system at this time. | ||
==<code>DeviceID</code>== | ==<code>DeviceID</code>== | ||
| − | The globally unique identifier given to the device by Windows. It does not correspond to any table in Truxton. | + | The globally unique identifier given to the device by Windows. |
| + | It does not correspond to any table in Truxton. | ||
Latest revision as of 07:32, 3 February 2024
This represents a USB device found in the exploited media. This table holds Universal Serial Bus devices, where they were found and when they were used.
Contents
SQL
CREATE TABLE "USBDevice"
(
"ID" uuid NOT NULL,
"FileID" uuid NOT NULL,
"MediaID" uuid NOT NULL,
"Offset" bigint DEFAULT (-1) NOT NULL,
"PID" integer DEFAULT 0 NOT NULL,
"VID" integer DEFAULT 0 NOT NULL,
"Revision" smallint DEFAULT 0 NOT NULL,
"USBDeviceTypeID" integer DEFAULT 0 NOT NULL,
"When" timestamp without time zone NOT NULL,
"DeviceID" uuid NOT NULL
);
Columns
ID
The globally unique identifier for this record. This is also the primary key for this table.
FileID
The globally unique identifier of the file this USB device reference was found.
It corresponds to the [ID] column of the [File] table.
MediaID
The globally unique identifier of the media this USB device was found in.
It corresponds to the [ID] column of the [Media] table.
Offset
The offset into the file where this USB device was referenced. If this value is -1, the offset was not known.
PID
The Product ID.
It corresponds to the [PID] column of the [USBPIDVID] table.
VID
Vendor Identifier.
It corresponds to the [VID] column of the [USBPIDVID] table.
Revision
The revision of the device.
USBDeviceTypeID
The type of device this is.
It corresponds to the [ID] column of the [USBDeviceType] table.
When
When the USB device was seen. The device was connected to the host system at this time.
DeviceID
The globally unique identifier given to the device by Windows. It does not correspond to any table in Truxton.
