USBDevice Table

This represents a USB device found in the exploited media. This table holds Universal Serial Bus devices, where they were found and when they were used.

SQL

CREATE TABLE "USBDevice"
(
  "ID" uuid NOT NULL,
  "FileID" uuid NOT NULL,
  "MediaID" uuid NOT NULL,
  "Offset" bigint DEFAULT (-1) NOT NULL,
  "PID" integer DEFAULT 0 NOT NULL,
  "VID" integer DEFAULT 0 NOT NULL,
  "Revision" smallint DEFAULT 0 NOT NULL,
  "USBDeviceTypeID" integer DEFAULT 0 NOT NULL,
  "When" timestamp without time zone NOT NULL,
  "DeviceID" uuid NOT NULL
);

Columns

ID

The globally unique identifier for this record. This is also the primary key for this table.

FileID

The globally unique identifier of the file this USB device reference was found. It corresponds to the [ID] column of the [File] table.

MediaID

The globally unique identifier of the media this USB device was found in. It corresponds to the [ID] column of the [Media] table.

Offset

The offset into the file where this USB device was referenced. If this value is -1, the offset was not known.

PID

The Product ID. It corresponds to the [PID] column of the [USBPIDVID] table.

VID

Vendor Identifier. It corresponds to the [VID] column of the [USBPIDVID] table.

Revision

The revision of the device.

USBDeviceTypeID

The type of device this is. It corresponds to the [ID] column of the [USBDeviceType] table.

When

When the USB device was seen. The device was connected to the host system at this time.

DeviceID

The globally unique identifier given to the device by Windows. It does not correspond to any table in Truxton.