dissect.target 3.19.dev23__tar.gz → 3.19.dev25__tar.gz

{dissect_target-3.19.dev23/dissect.target.egg-info → dissect_target-3.19.dev25}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dissect.target
-Version: 3.19.dev23
+Version: 3.19.dev25
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect_target-3.19.dev23 → dissect_target-3.19.dev25}/dissect/target/plugins/filesystem/ntfs/mft.py

@@ -1,9 +1,10 @@
 import logging
-from typing import Callable
+from typing import Callable, Iterator
 
 from dissect.ntfs.attr import Attribute
 from dissect.ntfs.c_ntfs import FILE_RECORD_SEGMENT_IN_USE
 from dissect.ntfs.mft import MftRecord
+from flow.record import Record
 from flow.record.fieldtypes import windows_path
 
 from dissect.target.exceptions import UnsupportedPluginError
@@ -53,7 +54,6 @@ FilesystemStdRecord = TargetRecordDescriptor(
     ],
 )
 
-
 FilesystemFilenameCompactRecord = TargetRecordDescriptor(
     "filesystem/ntfs/mft/filename/compact",
     [
@@ -90,6 +90,21 @@ FilesystemFilenameRecord = TargetRecordDescriptor(
     ],
 )
 
+FilesystemMACBRecord = TargetRecordDescriptor(
+    "filesystem/ntfs/mft/macb",
+    [
+        ("datetime", "ts"),
+        ("string", "macb"),
+        ("uint32", "filename_index"),
+        ("uint32", "segment"),
+        ("path", "path"),
+        ("string", "owner"),
+        ("filesize", "filesize"),
+        ("boolean", "resident"),
+        ("boolean", "inuse"),
+        ("string", "volume_uuid"),
+    ],
+)
 
 RECORD_TYPES = {
     InformationType.STANDARD_INFORMATION: FilesystemStdRecord,
@@ -118,7 +133,12 @@ class MftPlugin(Plugin):
         ]
     )
     @arg("--compact", action="store_true", help="compacts the MFT entry timestamps into a single record")
-    def mft(self, compact: bool = False):
+    @arg(
+        "--macb",
+        action="store_true",
+        help="compacts the MFT entry timestamps into aggregated records with MACB bitfield",
+    )
+    def mft(self, compact: bool = False, macb: bool = False):
         """Return the MFT records of all NTFS filesystems.
 
         The Master File Table (MFT) contains primarily metadata about every file and folder on a NFTS filesystem.
@@ -133,10 +153,19 @@ class MftPlugin(Plugin):
             - https://docs.microsoft.com/en-us/windows/win32/fileio/master-file-table
         """
 
-        if compact:
+        record_formatter = formatter
+
+        def noaggr(records: list[Record]) -> Iterator[Record]:
+            yield from records
+
+        aggr = noaggr
+
+        if compact and macb:
+            raise ValueError("--macb and --compact are mutually exclusive")
+        elif compact:
             record_formatter = compacted_formatter
-        else:
-            record_formatter = formatter
+        elif macb:
+            aggr = macb_aggr
 
         for fs in self.target.filesystems:
             if fs.__type__ != "ntfs":
@@ -167,17 +196,19 @@ class MftPlugin(Plugin):
 
                         for path in record.full_paths():
                             path = f"{drive_letter}{path}"
-                            yield from self.mft_records(
-                                drive_letter=drive_letter,
-                                record=record,
-                                segment=record.segment,
-                                path=path,
-                                owner=owner,
-                                size=size,
-                                resident=resident,
-                                inuse=inuse,
-                                volume_uuid=volume_uuid,
-                                record_formatter=record_formatter,
+                            yield from aggr(
+                                self.mft_records(
+                                    drive_letter=drive_letter,
+                                    record=record,
+                                    segment=record.segment,
+                                    path=path,
+                                    owner=owner,
+                                    size=size,
+                                    resident=resident,
+                                    inuse=inuse,
+                                    volume_uuid=volume_uuid,
+                                    record_formatter=record_formatter,
+                                )
                             )
                     except Exception as e:
                         self.target.log.warning("An error occured parsing MFT segment %d: %s", record.segment, str(e))
@@ -275,3 +306,33 @@ def formatter(attr: Attribute, record_type: InformationType, **kwargs):
         ("A", attr.last_access_time),
     ]:
         yield record_desc(ts=timestamp, ts_type=type, **kwargs)
+
+
+def macb_aggr(records: list[Record]) -> Iterator[Record]:
+    def macb_set(bitfield, index, letter):
+        return bitfield[:index] + letter + bitfield[index + 1 :]
+
+    macbs = []
+    for record in records:
+        found = False
+
+        offset_std = int(record._desc.name == "filesystem/ntfs/mft/std") * 5
+        offset_ads = (int(record.ads) * 10) if offset_std == 0 else 0
+
+        field = "MACB".find(record.ts_type) + offset_std + offset_ads
+        for macb in macbs:
+            if macb.ts == record.ts:
+                macb.macb = macb_set(macb.macb, field, record.ts_type)
+                found = True
+                break
+
+        if found:
+            continue
+
+        macb = FilesystemMACBRecord.init_from_record(record)
+        macb.macb = "..../..../...."
+        macb.macb = macb_set(macb.macb, field, record.ts_type)
+
+        macbs.append(macb)
+
+    yield from macbs

dissect_target-3.19.dev25/dissect/target/plugins/os/windows/regf/usb.py

@@ -0,0 +1,226 @@
+from __future__ import annotations
+
+import re
+import struct
+from typing import Iterator
+
+from dissect.util.ts import wintimestamp
+
+from dissect.target.exceptions import (
+    RegistryKeyNotFoundError,
+    RegistryValueNotFoundError,
+    UnsupportedPluginError,
+)
+from dissect.target.helpers.record import TargetRecordDescriptor
+from dissect.target.helpers.regutil import VirtualKey
+from dissect.target.plugin import Plugin, export
+
+UsbRegistryRecord = TargetRecordDescriptor(
+    "windows/registry/usb",
+    [
+        ("string", "type"),
+        ("string", "serial"),
+        ("string", "container_id"),
+        ("string", "vendor"),
+        ("string", "product"),
+        ("string", "revision"),
+        ("string", "friendly_name"),
+        ("datetime", "first_insert"),
+        ("datetime", "first_install"),
+        ("datetime", "last_insert"),
+        ("datetime", "last_removal"),
+        ("string[]", "volumes"),
+        ("string[]", "mounts"),
+        ("string[]", "users"),
+        ("path", "source"),
+    ],
+)
+
+USB_DEVICE_PROPERTY_KEYS = {
+    "first_install": ("0064", "00000064"),  # Windows 7 and higher. USB device first install date
+    "first_insert": ("0065", "00000065"),  # Windows 7 and higher. USB device first insert date.
+    "last_insert": ("0066", "00000066"),  # Windows 8 and higher. USB device last insert date.
+    "last_removal": ("0067", "00000067"),  # Windows 8 and higer. USB device last removal date.
+}
+
+RE_DEVICE_NAME = re.compile(r"^(?P<type>.+?)&Ven_(?P<vendor>.+?)&Prod_(?P<product>.+?)(&Rev_(?P<revision>.+?))?$")
+
+
+class UsbPlugin(Plugin):
+    """Windows USB history plugin.
+
+    Parses Windows registry data about attached USB devices. Does not parse EVTX EventIDs
+    or ``C:\\Windows\\inf\\setupapi(.dev).log``.
+
+    To get a full picture of the USB history on a Windows machine, you should parse the
+    relevant EventIDs using the evtx plugin. For more research on event log USB forensics, see:
+        - https://www.researchgate.net/publication/318514858
+        - https://dfir.pubpub.org/pub/h78di10n/release/2
+        - https://www.senturean.com/posts/19_08_03_usb_storage_forensics_1/#1-system-events
+
+    Resources:
+        - https://hatsoffsecurity.com/2014/06/05/usb-forensics-pt-1-serial-number/
+        - http://www.swiftforensics.com/2013/11/windows-8-new-registry-artifacts-part-1.html
+        - https://www.sans.org/blog/the-truth-about-usb-device-serial-numbers/
+    """
+
+    # Stores history of mounted USB devices
+    USB_STOR = "HKLM\\SYSTEM\\CurrentControlSet\\Enum\\USBSTOR"
+
+    # Stores the relation between a USB container_id and the FriendlyName of mounted volume(s) (Windows 7 and up)
+    PORTABLE_DEVICES = "HKLM\\SOFTWARE\\Microsoft\\Windows Portable Devices\\Devices"
+
+    # Stores the most recent mapping of a mount letter and a container_id
+    MOUNT_LETTER_MAP = "HKLM\\SYSTEM\\MountedDevices"
+
+    # User history of mount points accesses in explorer.exe
+    USER_MOUNTS = "HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Mountpoints2"
+
+    # Other artifacts we currently do not parse:
+    # - "sysvol\Windows\inf\setupapi(.dev).log"
+    # - "HKLM\\SYSTEM\\CurrentControlSet\\Enum\\USB"
+    # - "HKLM\\SYSTEM\\CurrentControlSet\\Enum\\HID"
+    # - "HKLM\\SYSTEM\\CurrentControlSet\\Enum\\SCSI"
+    # - "HKLM\\SYSTEM\\CurrentControlSet\\Control\\DeviceContainers"
+    # - "SOFTWARE\Microsoft\Windows NT\CurrentVersion\EMDMgmt"
+
+    def check_compatible(self) -> None:
+        if not list(self.target.registry.keys(self.USB_STOR)):
+            raise UnsupportedPluginError(f"Registry key not found: {self.USB_STOR}")
+
+    @export(record=UsbRegistryRecord)
+    def usb(self) -> Iterator[UsbRegistryRecord]:
+        """Yields information about (historically) attached USB storage devices on Windows.
+
+        Uses the registry to find information about USB storage devices that have been attached to the system.
+        Also tries to find the past volume name and mount letters of the USB device and what user(s) interacted
+        with them using ``explorer.exe``.
+        """
+
+        for key in self.target.registry.keys(self.USB_STOR):
+            for usb_type in key.subkeys():
+                try:
+                    device_info = parse_device_name(usb_type.name)
+                except ValueError:
+                    self.target.log.warning("Unable to parse USB device name: %s", usb_type.name)
+                    device_info = {"type": None, "vendor": None, "product": None, "revision": None}
+
+                for usb_device in usb_type.subkeys():
+                    serial = usb_device.name
+                    friendly_name = None
+                    container_id = None
+                    timestamps = {
+                        "first_install": None,
+                        "first_insert": None,
+                        "last_insert": None,
+                        "last_removal": None,
+                    }
+
+                    try:
+                        friendly_name = usb_device.value("FriendlyName").value
+                    except RegistryValueNotFoundError:
+                        self.target.log.warning("No FriendlyName for USB with serial: %s", serial)
+                        pass
+
+                    try:
+                        container_id = usb_device.value("ContainerID").value
+                    except RegistryValueNotFoundError:
+                        self.target.log.warning("No ContainerID for USB with serial: %s", serial)
+
+                    try:
+                        timestamps = unpack_timestamps(usb_device.subkey("Properties"))
+                    except RegistryValueNotFoundError as e:
+                        self.target.log.warning("Unable to parse USBSTOR registry properties for serial: %s", serial)
+                        self.target.log.debug("", exc_info=e)
+
+                    # We can check if any HKCU hive(s) are populated with the Volume GUID of the USB storage device.
+                    # If a user has interacted with the mounted volume using explorer.exe we will get a match.
+                    volumes = list(self.find_volumes(serial))
+                    mounts = list(self.find_mounts(serial))
+                    users = [
+                        u.user.name for u in self.find_users([m[10:] for m in mounts if m.startswith("\\??\\Volume{")])
+                    ]
+
+                    yield UsbRegistryRecord(
+                        friendly_name=friendly_name,
+                        serial=serial,
+                        container_id=container_id,
+                        **device_info,
+                        **timestamps,
+                        volumes=volumes,
+                        mounts=mounts,
+                        users=users,
+                        source=self.USB_STOR,
+                        _target=self.target,
+                    )
+
+    def find_volumes(self, serial: str) -> Iterator[str]:
+        """Attempts to find mounted volume names for the given serial."""
+        serial = serial.lower()
+        try:
+            for device in self.target.registry.key(self.PORTABLE_DEVICES).subkeys():
+                if serial in device.name.lower():
+                    yield device.value("FriendlyName").value
+        except RegistryKeyNotFoundError:
+            pass
+
+    def find_mounts(self, serial: str) -> Iterator[str]:
+        """Attempts to find drive letters the given serial has been mounted on."""
+        serial = serial.lower()
+        try:
+            for mount in self.target.registry.key(self.MOUNT_LETTER_MAP).values():
+                try:
+                    if serial in mount.value.decode("utf-16-le").lower():
+                        yield mount.name.replace("\\DosDevices\\", "")
+                except UnicodeDecodeError:
+                    pass
+        except RegistryKeyNotFoundError:
+            pass
+
+    def find_users(self, volume_guids: list[str]) -> Iterator[str]:
+        """Attempt to find Windows users that have interacted with the given volume GUIDs."""
+
+        for volume_guid in volume_guids:
+            try:
+                for key in self.target.registry.key(self.USER_MOUNTS + "\\" + volume_guid):
+                    yield self.target.registry.get_user_details(key)
+            except RegistryKeyNotFoundError:
+                pass
+
+
+def unpack_timestamps(usb_reg_properties: VirtualKey) -> dict[str, int]:
+    """Unpack relevant Windows timestamps from the provided USB registry properties subkey.
+
+    Args:
+        usb_reg_properties: A registry object with USB properties.
+
+    Returns:
+        A dict containing parsed timestamps within passed registry object.
+    """
+
+    usb_reg_properties = usb_reg_properties.subkey("{83da6326-97a6-4088-9453-a1923f573b29}")
+    timestamps = {}
+
+    for device_property, usbstor_values in USB_DEVICE_PROPERTY_KEYS.items():
+        for usb_val in usbstor_values:
+            if usb_val in [x.name for x in usb_reg_properties.subkeys()]:
+                version_key = usb_reg_properties.subkey(usb_val)
+                if "00000000" in version_key.subkeys():
+                    data_value = version_key.subkey("00000000").value("Data").value
+                else:
+                    data_value = version_key.value("(Default)").value
+                timestamps[device_property] = wintimestamp(struct.unpack("<Q", data_value)[0])
+                break
+            else:
+                timestamps[device_property] = None
+    return timestamps
+
+
+def parse_device_name(device_name: str) -> dict[str, str]:
+    """Parse a registry device name into components."""
+
+    match = RE_DEVICE_NAME.match(device_name)
+    if not match:
+        raise ValueError(f"Unable to parse USB device name: {device_name}")
+
+    return match.groupdict()

{dissect_target-3.19.dev23 → dissect_target-3.19.dev25/dissect.target.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dissect.target
-Version: 3.19.dev23
+Version: 3.19.dev25
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect_target-3.19.dev23 → dissect_target-3.19.dev25}/dissect.target.egg-info/SOURCES.txt

@@ -578,6 +578,7 @@ tests/plugins/os/windows/regf/test_clsid.py
 tests/plugins/os/windows/regf/test_muicache.py
 tests/plugins/os/windows/regf/test_shellbags.py
 tests/plugins/os/windows/regf/test_trusteddocs.py
+tests/plugins/os/windows/regf/test_usb.py
 tests/plugins/os/windows/regf/test_userassist.py
 tests/tools/__init__.py
 tests/tools/test_dump.py

{dissect_target-3.19.dev23 → dissect_target-3.19.dev25}/tests/plugins/filesystem/ntfs/test_mft.py

@@ -1,13 +1,20 @@
 import re
+from random import randrange
 from unittest.mock import Mock
 
 import pytest
 from dissect.ntfs.c_ntfs import ATTRIBUTE_TYPE_CODE
 from dissect.ntfs.exceptions import Error
 
+from dissect.target import Target
 from dissect.target.filesystem import VirtualFilesystem
 from dissect.target.filesystems.ntfs import NtfsFilesystem
-from dissect.target.plugins.filesystem.ntfs.mft import MftPlugin
+from dissect.target.plugins.filesystem.ntfs.mft import (
+    FilesystemFilenameRecord,
+    FilesystemStdRecord,
+    MftPlugin,
+    macb_aggr,
+)
 from dissect.target.plugins.filesystem.ntfs.mft_timeline import MftTimelinePlugin
 from dissect.target.plugins.filesystem.ntfs.utils import (
     get_drive_letter,
@@ -170,6 +177,40 @@ def test_mft_plugin_entries(target_win, compact):
     assert len(mft_data) == check_output_amount(76, compact)
 
 
+def test_mft_plugin_macb(target_win: Target) -> None:
+    load_mft_plugin(target_win)
+    mft_data = list(target_win.mft(macb=True))
+    path = None
+    ts = None
+    macb = None
+    field = "MACB/MACB/MACB"
+    for record in mft_data:
+        assert record.macb != macb or record.ts != ts or record.path != path
+        for bit in [0, 1, 2, 3, 5, 6, 7, 9, 10, 11, 12]:
+            assert record.macb[bit : bit + 1] in (field[bit : bit + 1], ".")
+        path = record.path
+        macb = record.macb
+        ts = record.ts
+
+
+def test_mft_plugin_macb_nodup() -> None:
+    # test whether you can never have duplicates
+
+    def make_ts(tss: set) -> int:
+        ts = randrange(1, 10)
+        tss.add(ts)
+        return ts
+
+    for _ in range(0, 100):
+        tss = set()
+        records = []
+        for ts_type in ["M", "A", "C", "B"]:
+            records.append(FilesystemStdRecord(path="a.txt", ts=make_ts(tss), ts_type=ts_type))
+            records.append(FilesystemFilenameRecord(path="a.txt", ts=make_ts(tss), ts_type=ts_type, ads=False))
+            records.append(FilesystemFilenameRecord(path="a.txt", ts=make_ts(tss), ts_type=ts_type, ads=True))
+        assert len(list(macb_aggr(records))) == len(tss)
+
+
 def test_mft_plugin_disk_label(target_win):
     load_mft_plugin(target_win)
     target_win.fs.mounts = {"c:": target_win.filesystems[0]}

dissect_target-3.19.dev25/tests/plugins/os/windows/regf/test_usb.py

@@ -0,0 +1,90 @@
+from unittest.mock import patch
+
+from flow.record.fieldtypes import datetime as dt
+
+from dissect.target.helpers.regutil import VirtualHive, VirtualKey, VirtualValue
+from dissect.target.plugins.os.windows.regf.usb import UsbPlugin
+from dissect.target.target import Target
+
+
+def test_windows_usb(target_win_users: Target, hive_hklm: VirtualHive, hive_hku: VirtualHive) -> None:
+    """test discovery of windows usb connection history"""
+
+    usbstor_name = "SYSTEM\\ControlSet001\\Enum\\USBSTOR\\Disk&Ven_SanDisk&Prod_Ultra&Rev_1.00"
+    usbstor_key = VirtualKey(hive_hklm, usbstor_name)
+
+    serial_name = "0401399b179e9d46555d8aa9d8618cd0a4f82512595aaea56a74bcd1c387638"
+    serial_key = VirtualKey(hive_hklm, serial_name)
+    serial_key.add_value(
+        "ContainerID", VirtualValue(hive_hklm, "ContainerID", "{3bceaa2e-d325-5328-ba38-d55baacd43d9}")
+    )
+    serial_key.add_value("FriendlyName", VirtualValue(hive_hklm, "FriendlyName", "SanDisk Ultra USB Device"))
+    serial_key.add_subkey("Device Parameters", VirtualKey(hive_hklm, "Device Parameters"))
+
+    properties_key = VirtualKey(hive_hklm, "Properties")
+    guid_key = VirtualKey(hive_hklm, "{83da6326-97a6-4088-9453-a1923f573b29}")
+
+    key_0064 = VirtualKey(hive_hklm, "0064")
+    key_0064.add_value("(Default)", VirtualValue(hive_hklm, "(Default)", b"\xea\x05+$T\xdf\xda\x01"))
+
+    key_0065 = VirtualKey(hive_hklm, "0065")
+    key_0065.add_value("(Default)", VirtualValue(hive_hklm, "(Default)", b"\xea\x05+$T\xdf\xda\x01"))
+
+    key_0066 = VirtualKey(hive_hklm, "0066")
+    key_0066.add_value("(Default)", VirtualValue(hive_hklm, "(Default)", b"\xea\x05+$T\xdf\xda\x01"))
+
+    key_0067 = VirtualKey(hive_hklm, "0067")
+    key_0067.add_value("(Default)", VirtualValue(hive_hklm, "(Default)", b"\x8b\xe0\x10\x96T\xdf\xda\x01"))
+
+    guid_key.add_subkey("0064", key_0064)
+    guid_key.add_subkey("0065", key_0065)
+    guid_key.add_subkey("0066", key_0066)
+    guid_key.add_subkey("0067", key_0067)
+    properties_key.add_subkey("{83da6326-97a6-4088-9453-a1923f573b29}", guid_key)
+    serial_key.add_subkey("Properties", properties_key)
+    usbstor_key.add_subkey(serial_name, serial_key)
+    hive_hklm.map_key(usbstor_name, usbstor_key)
+
+    mounted_devices = VirtualKey(hive_hklm, "SYSTEM\\MountedDevices")
+    mounted_devices.add_value(
+        "\\DosDevices\\E:", VirtualValue(hive_hklm, "\\DosDevices\\E:", serial_name.encode("utf-16-le"))
+    )
+    mounted_devices.add_value(
+        "\\??\\Volume{4be8862a-4b47-11ef-9a61-70d823df2914}",
+        VirtualValue(hive_hklm, "\\??\\Volume{4be8862a-4b47-11ef-9a61-70d823df2914}", serial_name.encode("utf-16-le")),
+    )
+    hive_hklm.map_key("SYSTEM\\MountedDevices", mounted_devices)
+
+    mounted_volumes_name = "SOFTWARE\\Microsoft\\Windows Portable Devices\\Devices\\SWD#WPDBUSENUM#_??_USBSTOR#DISK&VEN_SANDISK&PROD_ULTRA&REV_1.00#0401399B179E9D46555D8AA9D8618CD0A4F82512595AAEA56A74BCD1C387638#{53F56307-B6BF-11D0-94F2-00A0C91EFB8B}"  # noqa: E501
+    mounted_volumes = VirtualKey(hive_hklm, mounted_volumes_name)
+    mounted_volumes.add_value("FriendlyName", VirtualValue(hive_hklm, "FriendlyName", "Example USB"))
+    hive_hklm.map_key(mounted_volumes_name, mounted_volumes)
+
+    mountpoints2_name = (
+        "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Mountpoints2\\{4be8862a-4b47-11ef-9a61-70d823df2914}"
+    )
+    mountpoints2 = VirtualKey(hive_hku, mountpoints2_name)
+    hive_hku.map_key(mountpoints2_name, mountpoints2)
+
+    target_win_users.add_plugin(UsbPlugin)
+
+    with patch("dissect.target.plugins.os.windows.registry.RegistryPlugin.get_user_details") as mock_reg_user_details:
+        mock_reg_user_details.return_value = target_win_users.user_details.find(username="John")
+        results = list(target_win_users.usb())
+
+    assert len(results) == 1
+    assert results[0].type == "Disk"
+    assert results[0].serial == "0401399b179e9d46555d8aa9d8618cd0a4f82512595aaea56a74bcd1c387638"
+    assert results[0].container_id == "{3bceaa2e-d325-5328-ba38-d55baacd43d9}"
+    assert results[0].vendor == "SanDisk"
+    assert results[0].product == "Ultra"
+    assert results[0].revision == "1.00"
+    assert results[0].friendly_name == "SanDisk Ultra USB Device"
+    assert results[0].first_insert == dt("2024-07-26 12:05:43.789719+00:00")
+    assert results[0].first_install == dt("2024-07-26 12:05:43.789719+00:00")
+    assert results[0].last_insert == dt("2024-07-26 12:05:43.789719+00:00")
+    assert results[0].last_removal == dt("2024-07-26 12:08:54.878632+00:00")
+    assert results[0].volumes == ["Example USB"]
+    assert results[0].mounts == ["E:", "\\??\\Volume{4be8862a-4b47-11ef-9a61-70d823df2914}"]
+    assert results[0].users == ["John"]
+    assert results[0].source == "HKLM\\SYSTEM\\CurrentControlSet\\Enum\\USBSTOR"