using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Data;
using System.Drawing;
using System.Text;
using System.Windows.Forms;
using Microsoft.Win32;
namespace USBforensic1
{
public partial class Form1 : Form
{
public Form1()
{
InitializeComponent();
}
private void button1_Click(object sender, EventArgs e)
{
RegistryKey USBConnKey;
USBConnKey = Registry.LocalMachine.OpenSubKey(@"SYSTEM\CurrentControlSet\Enum\USBSTOR", false);
foreach (string sub1 in USBConnKey.GetSubKeyNames())
{
RegistryKey sub1key = USBConnKey.OpenSubKey(sub1, false);
foreach (string sub2 in sub1key.GetSubKeyNames())
{
try
{
RegistryKey sub2key = sub1key.OpenSubKey(sub2, false);
if (sub2key.GetValue("Service", "").Equals("disk"))
{
String Path = "USBSTOR" + "\\" + sub1 + "\\" + sub2;
String Name = (string)sub2key.GetValue("FriendlyName", "");
richTextBox1.AppendText("USB名称 " + Name + "\r\n");
richTextBox1.AppendText("UID标记 " + sub2 + "\r\n");
richTextBox1.AppendText("路径信息 " + Path + "\r\n\r\n");
}
}
catch (Exception msg)
{
MessageBox.Show(msg.Message);
}
}
}
}
}
}