This program can correlate the dates of USB mass device connections with recent files and export a report in CSV format
Free, open-source automation of Windows forensic examinations: load an E01/raw/VMDK/VHDX image, pick a case type (DLP, USB, malware, phishing, ClickFix, RMM, ransomware), get answered questions, every parsed artifact as CSV and a court-ready report. Validated against NIST CFReDS.
ExamGurad is a portable Windows cyber-forensic tool that collects USB device history, event logs, and system activity evidence for academic integrity investigations.
Digital forensics investigation involving USB evidence, file signature analysis, and email examination in an intellectual property theft case.
Gives you the list of storage devices that has been connected to your windows machine
Kit portátil de resposta a incidentes (DFIR) para Windows: scripts PowerShell que montam um pendrive com ferramentas forenses gratuitas e automatizam a coleta de evidências.
USB device-history correlation engine — reconstructs USB connection history from every Windows artifact (registry, SetupAPI, event logs, LNK) plus macOS/Linux, and scores cross-source timestamp consistency by tamper-independence. Runs headless on any OS; pipeline-native JSONL, reproducible, panic-free.
To associate your repository with the usb-forensics topic, visit your repo's landing page and select "manage topics."