dissect.target 3.19.dev22__tar.gz → 3.19.dev24__tar.gz

{dissect_target-3.19.dev22/dissect.target.egg-info → dissect_target-3.19.dev24}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dissect.target
-Version: 3.19.dev22
+Version: 3.19.dev24
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect_target-3.19.dev22 → dissect_target-3.19.dev24}/dissect/target/helpers/network_managers.py

@@ -7,12 +7,14 @@ from configparser import ConfigParser, MissingSectionHeaderError
 from io import StringIO
 from itertools import chain
 from re import compile, sub
-from typing import Any, Callable, Iterable, Match, Optional
+from typing import Any, Callable, Iterable, Iterator, Match, Optional
 
 from defusedxml import ElementTree
 
 from dissect.target.exceptions import PluginError
 from dissect.target.helpers.fsutil import TargetPath
+from dissect.target.plugins.os.unix.log.journal import JournalRecord
+from dissect.target.plugins.os.unix.log.messages import MessagesRecord
 from dissect.target.target import Target
 
 log = logging.getLogger(__name__)
@@ -509,14 +511,15 @@ class LinuxNetworkManager:
         return values
 
 
-def parse_unix_dhcp_log_messages(target) -> list[str]:
+def parse_unix_dhcp_log_messages(target: Target, iter_all: bool = False) -> set[str]:
     """Parse local syslog, journal and cloud init-log files for DHCP lease IPs.
 
     Args:
         target: Target to discover and obtain network information from.
+        iter_all: Parse limited amount of journal messages (first 10000) or all of them.
 
     Returns:
-        List of DHCP ip addresses.
+        A set of found DHCP IP addresses.
     """
     ips = set()
     messages = set()
@@ -530,9 +533,19 @@ def parse_unix_dhcp_log_messages(target) -> list[str]:
     if not messages:
         target.log.warning(f"Could not search for DHCP leases using {log_func}: No log entries found.")
 
-    for record in messages:
+    def records_enumerate(iterable: Iterable) -> Iterator[tuple[int, JournalRecord | MessagesRecord]]:
+        count = 0
+        for rec in iterable:
+            if rec._desc.name == "linux/log/journal":
+                count += 1
+            yield count, rec
+
+    for count, record in records_enumerate(messages):
         line = record.message
 
+        if not line:
+            continue
+
         # Ubuntu cloud-init
         if "Received dhcp lease on" in line:
             interface, ip, netmask = re.search(r"Received dhcp lease on (\w{0,}) for (\S+)\/(\S+)", line).groups()
@@ -576,9 +589,11 @@ def parse_unix_dhcp_log_messages(target) -> list[str]:
             ips.add(ip)
             continue
 
-        # Journals and syslogs can be large and slow to iterate,
-        # so we stop if we have some results and have reached the journal plugin.
-        if len(ips) >= 2 and record._desc.name == "linux/log/journal":
+        # The journal parser is relatively slow, so we stop when we have read 10000 journal entries,
+        # or if we have found at least one ip address. When `iter_all` is `True` we continue searching.
+        if not iter_all and (ips or count > 10_000):
+            if not ips:
+                target.log.warning("No DHCP IP addresses found in first 10000 journal entries.")
             break
 
     return ips

{dissect_target-3.19.dev22 → dissect_target-3.19.dev24}/dissect/target/plugins/os/unix/linux/_os.py

@@ -41,7 +41,7 @@ class LinuxPlugin(UnixPlugin, LinuxNetworkManager):
             for ip in ip_set:
                 ips.append(ip)
 
-        for ip in parse_unix_dhcp_log_messages(self.target):
+        for ip in parse_unix_dhcp_log_messages(self.target, iter_all=False):
             if ip not in ips:
                 ips.append(ip)
 

dissect_target-3.19.dev24/dissect/target/plugins/os/windows/regf/usb.py

@@ -0,0 +1,226 @@
+from __future__ import annotations
+
+import re
+import struct
+from typing import Iterator
+
+from dissect.util.ts import wintimestamp
+
+from dissect.target.exceptions import (
+    RegistryKeyNotFoundError,
+    RegistryValueNotFoundError,
+    UnsupportedPluginError,
+)
+from dissect.target.helpers.record import TargetRecordDescriptor
+from dissect.target.helpers.regutil import VirtualKey
+from dissect.target.plugin import Plugin, export
+
+UsbRegistryRecord = TargetRecordDescriptor(
+    "windows/registry/usb",
+    [
+        ("string", "type"),
+        ("string", "serial"),
+        ("string", "container_id"),
+        ("string", "vendor"),
+        ("string", "product"),
+        ("string", "revision"),
+        ("string", "friendly_name"),
+        ("datetime", "first_insert"),
+        ("datetime", "first_install"),
+        ("datetime", "last_insert"),
+        ("datetime", "last_removal"),
+        ("string[]", "volumes"),
+        ("string[]", "mounts"),
+        ("string[]", "users"),
+        ("path", "source"),
+    ],
+)
+
+USB_DEVICE_PROPERTY_KEYS = {
+    "first_install": ("0064", "00000064"),  # Windows 7 and higher. USB device first install date
+    "first_insert": ("0065", "00000065"),  # Windows 7 and higher. USB device first insert date.
+    "last_insert": ("0066", "00000066"),  # Windows 8 and higher. USB device last insert date.
+    "last_removal": ("0067", "00000067"),  # Windows 8 and higer. USB device last removal date.
+}
+
+RE_DEVICE_NAME = re.compile(r"^(?P<type>.+?)&Ven_(?P<vendor>.+?)&Prod_(?P<product>.+?)(&Rev_(?P<revision>.+?))?$")
+
+
+class UsbPlugin(Plugin):
+    """Windows USB history plugin.
+
+    Parses Windows registry data about attached USB devices. Does not parse EVTX EventIDs
+    or ``C:\\Windows\\inf\\setupapi(.dev).log``.
+
+    To get a full picture of the USB history on a Windows machine, you should parse the
+    relevant EventIDs using the evtx plugin. For more research on event log USB forensics, see:
+        - https://www.researchgate.net/publication/318514858
+        - https://dfir.pubpub.org/pub/h78di10n/release/2
+        - https://www.senturean.com/posts/19_08_03_usb_storage_forensics_1/#1-system-events
+
+    Resources:
+        - https://hatsoffsecurity.com/2014/06/05/usb-forensics-pt-1-serial-number/
+        - http://www.swiftforensics.com/2013/11/windows-8-new-registry-artifacts-part-1.html
+        - https://www.sans.org/blog/the-truth-about-usb-device-serial-numbers/
+    """
+
+    # Stores history of mounted USB devices
+    USB_STOR = "HKLM\\SYSTEM\\CurrentControlSet\\Enum\\USBSTOR"
+
+    # Stores the relation between a USB container_id and the FriendlyName of mounted volume(s) (Windows 7 and up)
+    PORTABLE_DEVICES = "HKLM\\SOFTWARE\\Microsoft\\Windows Portable Devices\\Devices"
+
+    # Stores the most recent mapping of a mount letter and a container_id
+    MOUNT_LETTER_MAP = "HKLM\\SYSTEM\\MountedDevices"
+
+    # User history of mount points accesses in explorer.exe
+    USER_MOUNTS = "HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Mountpoints2"
+
+    # Other artifacts we currently do not parse:
+    # - "sysvol\Windows\inf\setupapi(.dev).log"
+    # - "HKLM\\SYSTEM\\CurrentControlSet\\Enum\\USB"
+    # - "HKLM\\SYSTEM\\CurrentControlSet\\Enum\\HID"
+    # - "HKLM\\SYSTEM\\CurrentControlSet\\Enum\\SCSI"
+    # - "HKLM\\SYSTEM\\CurrentControlSet\\Control\\DeviceContainers"
+    # - "SOFTWARE\Microsoft\Windows NT\CurrentVersion\EMDMgmt"
+
+    def check_compatible(self) -> None:
+        if not list(self.target.registry.keys(self.USB_STOR)):
+            raise UnsupportedPluginError(f"Registry key not found: {self.USB_STOR}")
+
+    @export(record=UsbRegistryRecord)
+    def usb(self) -> Iterator[UsbRegistryRecord]:
+        """Yields information about (historically) attached USB storage devices on Windows.
+
+        Uses the registry to find information about USB storage devices that have been attached to the system.
+        Also tries to find the past volume name and mount letters of the USB device and what user(s) interacted
+        with them using ``explorer.exe``.
+        """
+
+        for key in self.target.registry.keys(self.USB_STOR):
+            for usb_type in key.subkeys():
+                try:
+                    device_info = parse_device_name(usb_type.name)
+                except ValueError:
+                    self.target.log.warning("Unable to parse USB device name: %s", usb_type.name)
+                    device_info = {"type": None, "vendor": None, "product": None, "revision": None}
+
+                for usb_device in usb_type.subkeys():
+                    serial = usb_device.name
+                    friendly_name = None
+                    container_id = None
+                    timestamps = {
+                        "first_install": None,
+                        "first_insert": None,
+                        "last_insert": None,
+                        "last_removal": None,
+                    }
+
+                    try:
+                        friendly_name = usb_device.value("FriendlyName").value
+                    except RegistryValueNotFoundError:
+                        self.target.log.warning("No FriendlyName for USB with serial: %s", serial)
+                        pass
+
+                    try:
+                        container_id = usb_device.value("ContainerID").value
+                    except RegistryValueNotFoundError:
+                        self.target.log.warning("No ContainerID for USB with serial: %s", serial)
+
+                    try:
+                        timestamps = unpack_timestamps(usb_device.subkey("Properties"))
+                    except RegistryValueNotFoundError as e:
+                        self.target.log.warning("Unable to parse USBSTOR registry properties for serial: %s", serial)
+                        self.target.log.debug("", exc_info=e)
+
+                    # We can check if any HKCU hive(s) are populated with the Volume GUID of the USB storage device.
+                    # If a user has interacted with the mounted volume using explorer.exe we will get a match.
+                    volumes = list(self.find_volumes(serial))
+                    mounts = list(self.find_mounts(serial))
+                    users = [
+                        u.user.name for u in self.find_users([m[10:] for m in mounts if m.startswith("\\??\\Volume{")])
+                    ]
+
+                    yield UsbRegistryRecord(
+                        friendly_name=friendly_name,
+                        serial=serial,
+                        container_id=container_id,
+                        **device_info,
+                        **timestamps,
+                        volumes=volumes,
+                        mounts=mounts,
+                        users=users,
+                        source=self.USB_STOR,
+                        _target=self.target,
+                    )
+
+    def find_volumes(self, serial: str) -> Iterator[str]:
+        """Attempts to find mounted volume names for the given serial."""
+        serial = serial.lower()
+        try:
+            for device in self.target.registry.key(self.PORTABLE_DEVICES).subkeys():
+                if serial in device.name.lower():
+                    yield device.value("FriendlyName").value
+        except RegistryKeyNotFoundError:
+            pass
+
+    def find_mounts(self, serial: str) -> Iterator[str]:
+        """Attempts to find drive letters the given serial has been mounted on."""
+        serial = serial.lower()
+        try:
+            for mount in self.target.registry.key(self.MOUNT_LETTER_MAP).values():
+                try:
+                    if serial in mount.value.decode("utf-16-le").lower():
+                        yield mount.name.replace("\\DosDevices\\", "")
+                except UnicodeDecodeError:
+                    pass
+        except RegistryKeyNotFoundError:
+            pass
+
+    def find_users(self, volume_guids: list[str]) -> Iterator[str]:
+        """Attempt to find Windows users that have interacted with the given volume GUIDs."""
+
+        for volume_guid in volume_guids:
+            try:
+                for key in self.target.registry.key(self.USER_MOUNTS + "\\" + volume_guid):
+                    yield self.target.registry.get_user_details(key)
+            except RegistryKeyNotFoundError:
+                pass
+
+
+def unpack_timestamps(usb_reg_properties: VirtualKey) -> dict[str, int]:
+    """Unpack relevant Windows timestamps from the provided USB registry properties subkey.
+
+    Args:
+        usb_reg_properties: A registry object with USB properties.
+
+    Returns:
+        A dict containing parsed timestamps within passed registry object.
+    """
+
+    usb_reg_properties = usb_reg_properties.subkey("{83da6326-97a6-4088-9453-a1923f573b29}")
+    timestamps = {}
+
+    for device_property, usbstor_values in USB_DEVICE_PROPERTY_KEYS.items():
+        for usb_val in usbstor_values:
+            if usb_val in [x.name for x in usb_reg_properties.subkeys()]:
+                version_key = usb_reg_properties.subkey(usb_val)
+                if "00000000" in version_key.subkeys():
+                    data_value = version_key.subkey("00000000").value("Data").value
+                else:
+                    data_value = version_key.value("(Default)").value
+                timestamps[device_property] = wintimestamp(struct.unpack("<Q", data_value)[0])
+                break
+            else:
+                timestamps[device_property] = None
+    return timestamps
+
+
+def parse_device_name(device_name: str) -> dict[str, str]:
+    """Parse a registry device name into components."""
+
+    match = RE_DEVICE_NAME.match(device_name)
+    if not match:
+        raise ValueError(f"Unable to parse USB device name: {device_name}")
+
+    return match.groupdict()

{dissect_target-3.19.dev22 → dissect_target-3.19.dev24/dissect.target.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dissect.target
-Version: 3.19.dev22
+Version: 3.19.dev24
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect_target-3.19.dev22 → dissect_target-3.19.dev24}/dissect.target.egg-info/SOURCES.txt

@@ -578,6 +578,7 @@ tests/plugins/os/windows/regf/test_clsid.py
 tests/plugins/os/windows/regf/test_muicache.py
 tests/plugins/os/windows/regf/test_shellbags.py
 tests/plugins/os/windows/regf/test_trusteddocs.py
+tests/plugins/os/windows/regf/test_usb.py
 tests/plugins/os/windows/regf/test_userassist.py
 tests/tools/__init__.py
 tests/tools/test_dump.py

{dissect_target-3.19.dev22 → dissect_target-3.19.dev24}/tests/plugins/os/unix/test_ips.py

@@ -1,5 +1,6 @@
 import textwrap
 from io import BytesIO
+from unittest.mock import patch
 
 import pytest
 
@@ -7,21 +8,40 @@ from dissect.target import Target
 from dissect.target.filesystem import VirtualFilesystem
 from dissect.target.helpers.network_managers import NetworkManager
 from dissect.target.plugins.os.unix.linux._os import LinuxPlugin
+from dissect.target.tools.query import main as target_query
 from tests._utils import absolute_path
 
 
-def test_ips_dhcp(target_unix_users: Target, fs_unix: VirtualFilesystem) -> None:
+@pytest.mark.parametrize(
+    "expected_ips, messages",
+    [
+        (
+            ["10.13.37.1"],
+            "Jan  1 13:37:01 hostname NetworkManager[1]: <info>  [1600000000.0000] dhcp4 (eth0): option ip_address           => '10.13.37.1'",  # noqa: E501
+        ),
+        (["10.13.37.2"], "Feb  2 13:37:02 test systemd-networkd[2]: eth0: DHCPv4 address 10.13.37.2/24 via 10.13.37.0"),
+        (
+            ["10.13.37.3"],
+            "Mar  3 13:37:03 localhost NetworkManager[3]: <info>  [1600000000.0003] dhcp4 (eth0):   address 10.13.37.3",
+        ),
+        (
+            ["10.13.37.4"],
+            "Apr  4 13:37:04 localhost dhclient[4]: bound to 10.13.37.4 -- renewal in 1337 seconds.",
+        ),
+        (
+            ["2001:db8::"],
+            (
+                "Jun  6 13:37:06 test systemd-networkd[5]: eth0: DHCPv6 address 2001:db8::/64 via 2001:db8:ffff:ffff:ffff:ffff:ffff:ffff\n"  # noqa: E501
+                "May  5 13:37:05 test systemd-networkd[5]: eth0: DHCPv6 lease lost\n"
+            ),
+        ),
+    ],
+)
+def test_ips_dhcp(
+    target_unix_users: Target, fs_unix: VirtualFilesystem, expected_ips: list[str], messages: str
+) -> None:
     """Test DHCP lease messages from /var/log/syslog."""
 
-    messages = """
-    Jan  1 13:37:01 hostname NetworkManager[1]: <info>  [1600000000.0000] dhcp4 (eth0): option ip_address           => '10.13.37.1'
-    Feb  2 13:37:02 test systemd-networkd[2]: eth0: DHCPv4 address 10.13.37.2/24 via 10.13.37.0
-    Mar  3 13:37:03 localhost NetworkManager[3]: <info>  [1600000000.0003] dhcp4 (eth0):   address 10.13.37.3
-    Apr  4 13:37:04 localhost dhclient[4]: bound to 10.13.37.4 -- renewal in 1337 seconds.
-    May  5 13:37:05 test systemd-networkd[5]: eth0: DHCPv6 lease lost
-    Jun  6 13:37:06 test systemd-networkd[5]: eth0: DHCPv6 address 2001:db8::/64 via 2001:db8:ffff:ffff:ffff:ffff:ffff:ffff
-    """  # noqa E501
-
     fs_unix.map_file_fh(
         "/var/log/syslog",
         BytesIO(textwrap.dedent(messages).encode()),
@@ -30,8 +50,53 @@ def test_ips_dhcp(target_unix_users: Target, fs_unix: VirtualFilesystem) -> None
     target_unix_users.add_plugin(LinuxPlugin)
     results = target_unix_users.ips
     results.reverse()
-    assert len(results) == 5
-    assert sorted(results) == ["10.13.37.1", "10.13.37.2", "10.13.37.3", "10.13.37.4", "2001:db8::"]
+    assert len(results) == len(expected_ips)
+    assert sorted(results) == expected_ips
+
+
+@pytest.mark.parametrize(
+    "flag, expected_out",
+    [
+        (None, "['10.13.37.2']"),
+        # ("--dhcp-all", "['10.13.37.2', '10.13.37.1']"),
+        # Temporarily disabled behaviour, for discussion see:
+        # https://github.com/fox-it/dissect.target/pull/687#discussion_r1698515269
+    ],
+)
+def test_ips_dhcp_arg(
+    target_unix: Target,
+    fs_unix: VirtualFilesystem,
+    flag: str,
+    expected_out: str,
+    capsys: pytest.CaptureFixture,
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    """Test --dhcp-all flag behaviour"""
+
+    fs_unix.map_file_fh("/etc/timezone", BytesIO(b"Europe/Amsterdam"))
+
+    messages = """
+    Apr  1 13:37:01 localhost dhclient[4]: bound to 10.13.37.1 -- renewal in 1337 seconds.
+    Apr  2 13:37:02 localhost foo[1]: some other message.
+    Apr  3 13:37:03 localhost dhclient[4]: bound to 10.13.37.2 -- renewal in 1337 seconds.
+    """
+
+    fs_unix.map_file_fh(
+        "/var/log/syslog",
+        BytesIO(textwrap.dedent(messages).encode()),
+    )
+    target_unix.add_plugin(LinuxPlugin)
+
+    argv = ["target-query", "foo", "-f", "ips"]
+    if flag:
+        argv.append(flag)
+
+    with patch("dissect.target.Target.open_all", return_value=[target_unix]):
+        with monkeypatch.context() as m:
+            m.setattr("sys.argv", argv)
+            target_query()
+            out, _ = capsys.readouterr()
+            assert expected_out in out
 
 
 def test_ips_cloud_init(target_unix_users: Target, fs_unix: VirtualFilesystem) -> None:

dissect_target-3.19.dev24/tests/plugins/os/windows/regf/test_usb.py

@@ -0,0 +1,90 @@
+from unittest.mock import patch
+
+from flow.record.fieldtypes import datetime as dt
+
+from dissect.target.helpers.regutil import VirtualHive, VirtualKey, VirtualValue
+from dissect.target.plugins.os.windows.regf.usb import UsbPlugin
+from dissect.target.target import Target
+
+
+def test_windows_usb(target_win_users: Target, hive_hklm: VirtualHive, hive_hku: VirtualHive) -> None:
+    """test discovery of windows usb connection history"""
+
+    usbstor_name = "SYSTEM\\ControlSet001\\Enum\\USBSTOR\\Disk&Ven_SanDisk&Prod_Ultra&Rev_1.00"
+    usbstor_key = VirtualKey(hive_hklm, usbstor_name)
+
+    serial_name = "0401399b179e9d46555d8aa9d8618cd0a4f82512595aaea56a74bcd1c387638"
+    serial_key = VirtualKey(hive_hklm, serial_name)
+    serial_key.add_value(
+        "ContainerID", VirtualValue(hive_hklm, "ContainerID", "{3bceaa2e-d325-5328-ba38-d55baacd43d9}")
+    )
+    serial_key.add_value("FriendlyName", VirtualValue(hive_hklm, "FriendlyName", "SanDisk Ultra USB Device"))
+    serial_key.add_subkey("Device Parameters", VirtualKey(hive_hklm, "Device Parameters"))
+
+    properties_key = VirtualKey(hive_hklm, "Properties")
+    guid_key = VirtualKey(hive_hklm, "{83da6326-97a6-4088-9453-a1923f573b29}")
+
+    key_0064 = VirtualKey(hive_hklm, "0064")
+    key_0064.add_value("(Default)", VirtualValue(hive_hklm, "(Default)", b"\xea\x05+$T\xdf\xda\x01"))
+
+    key_0065 = VirtualKey(hive_hklm, "0065")
+    key_0065.add_value("(Default)", VirtualValue(hive_hklm, "(Default)", b"\xea\x05+$T\xdf\xda\x01"))
+
+    key_0066 = VirtualKey(hive_hklm, "0066")
+    key_0066.add_value("(Default)", VirtualValue(hive_hklm, "(Default)", b"\xea\x05+$T\xdf\xda\x01"))
+
+    key_0067 = VirtualKey(hive_hklm, "0067")
+    key_0067.add_value("(Default)", VirtualValue(hive_hklm, "(Default)", b"\x8b\xe0\x10\x96T\xdf\xda\x01"))
+
+    guid_key.add_subkey("0064", key_0064)
+    guid_key.add_subkey("0065", key_0065)
+    guid_key.add_subkey("0066", key_0066)
+    guid_key.add_subkey("0067", key_0067)
+    properties_key.add_subkey("{83da6326-97a6-4088-9453-a1923f573b29}", guid_key)
+    serial_key.add_subkey("Properties", properties_key)
+    usbstor_key.add_subkey(serial_name, serial_key)
+    hive_hklm.map_key(usbstor_name, usbstor_key)
+
+    mounted_devices = VirtualKey(hive_hklm, "SYSTEM\\MountedDevices")
+    mounted_devices.add_value(
+        "\\DosDevices\\E:", VirtualValue(hive_hklm, "\\DosDevices\\E:", serial_name.encode("utf-16-le"))
+    )
+    mounted_devices.add_value(
+        "\\??\\Volume{4be8862a-4b47-11ef-9a61-70d823df2914}",
+        VirtualValue(hive_hklm, "\\??\\Volume{4be8862a-4b47-11ef-9a61-70d823df2914}", serial_name.encode("utf-16-le")),
+    )
+    hive_hklm.map_key("SYSTEM\\MountedDevices", mounted_devices)
+
+    mounted_volumes_name = "SOFTWARE\\Microsoft\\Windows Portable Devices\\Devices\\SWD#WPDBUSENUM#_??_USBSTOR#DISK&VEN_SANDISK&PROD_ULTRA&REV_1.00#0401399B179E9D46555D8AA9D8618CD0A4F82512595AAEA56A74BCD1C387638#{53F56307-B6BF-11D0-94F2-00A0C91EFB8B}"  # noqa: E501
+    mounted_volumes = VirtualKey(hive_hklm, mounted_volumes_name)
+    mounted_volumes.add_value("FriendlyName", VirtualValue(hive_hklm, "FriendlyName", "Example USB"))
+    hive_hklm.map_key(mounted_volumes_name, mounted_volumes)
+
+    mountpoints2_name = (
+        "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Mountpoints2\\{4be8862a-4b47-11ef-9a61-70d823df2914}"
+    )
+    mountpoints2 = VirtualKey(hive_hku, mountpoints2_name)
+    hive_hku.map_key(mountpoints2_name, mountpoints2)
+
+    target_win_users.add_plugin(UsbPlugin)
+
+    with patch("dissect.target.plugins.os.windows.registry.RegistryPlugin.get_user_details") as mock_reg_user_details:
+        mock_reg_user_details.return_value = target_win_users.user_details.find(username="John")
+        results = list(target_win_users.usb())
+
+    assert len(results) == 1
+    assert results[0].type == "Disk"
+    assert results[0].serial == "0401399b179e9d46555d8aa9d8618cd0a4f82512595aaea56a74bcd1c387638"
+    assert results[0].container_id == "{3bceaa2e-d325-5328-ba38-d55baacd43d9}"
+    assert results[0].vendor == "SanDisk"
+    assert results[0].product == "Ultra"
+    assert results[0].revision == "1.00"
+    assert results[0].friendly_name == "SanDisk Ultra USB Device"
+    assert results[0].first_insert == dt("2024-07-26 12:05:43.789719+00:00")
+    assert results[0].first_install == dt("2024-07-26 12:05:43.789719+00:00")
+    assert results[0].last_insert == dt("2024-07-26 12:05:43.789719+00:00")
+    assert results[0].last_removal == dt("2024-07-26 12:08:54.878632+00:00")
+    assert results[0].volumes == ["Example USB"]
+    assert results[0].mounts == ["E:", "\\??\\Volume{4be8862a-4b47-11ef-9a61-70d823df2914}"]
+    assert results[0].users == ["John"]
+    assert results[0].source == "HKLM\\SYSTEM\\CurrentControlSet\\Enum\\USBSTOR"