Crate peripheral_core 

peripheral-core — external-device (peripheral) connection forensic reader.

Parses Windows setupapi.dev.log device-installation logs into a uniform DeviceConnection stream: bus-classified, with each timestamp tagged authoritative-vs-inferred and the USB iSerial kept distinct from any volume serial. The input is attacker-controllable evidence — parsing is lenient (lossy UTF-8), bounds-checked, and never panics. No unsafe.

Findings (DMA-capable device, mass-storage, HID/BadUSB, OS-generated serial) live in the sibling peripheral-forensic crate; this crate only decodes.

v0.2 enrichment (not in this release)

The richest source — the Windows registry SYSTEM\CurrentControlSet\Enum\ keys (USBSTOR/USB), MountedDevices, and the device-property 0066/0067 Last-Arrival/Last-Removal FILETIMEs — plus EVTX device events require the (unpublished) winreg-core and winevt-forensic crates. They are deferred to v0.2; v0.1 is scoped to the self-contained setupapi.dev.log source.

Modules

emdmgmt

Volume label + serial history: decode EMDMgmt from a Windows SOFTWARE hive.

linux_syslog

Linux kernel-log (syslog / dmesg) USB device reader.

mounted_volumes

MBR-signature volume bridge: decode MountedDevices MBR records from a Windows SYSTEM hive.

mountpoints2

Per-user volume mounts: decode MountPoints2 from a Windows NTUSER.DAT hive.

registry

Registry device source: decode USB / SCSI / USBSTOR device instances from a Windows SYSTEM hive into DeviceConnection records, complementing the setupapi source.

setupapi

Parser for Windows setupapi.dev.log (Vista+) and setupapi.log (XP) device-installation logs.

volume_info

Volume-label source: decode VolumeInfoCache from a Windows SOFTWARE hive.

Structs

DeviceConnection

One external-device connection, normalized across sources.

MitreRef

A MITRE ATT&CK technique a connection is consistent with — never a verdict.

Provenance

Where a DeviceConnection was decoded from.

Stamp

A timestamp tagged with its evidentiary confidence.

Enums

Bus

The physical/logical bus a peripheral attached through.

Confidence

How much trust a timestamp carries.