Expand description
Registry device source: decode USB / SCSI / USBSTOR device instances from a Windows
SYSTEM hive into DeviceConnection records, complementing the setupapi source.
Device instances live under ControlSet00X\Enum\{USBSTOR,SCSI,USB}\<Ven&Prod>\<instance>.
Per-device timestamps live in the undocumented device-property subtree
Properties\{83da6326-97a6-4088-9453-a1923f573b29}\<PROP> whose default value is a
FILETIME: 0064 install, 0065 first-install (both documented → authoritative),
0066 last-arrival/connect, 0067 last-removal/disconnect (undocumented → inferred).
Functions§
- parse_
registry - Parse USB / SCSI / USBSTOR device instances from an already-opened
SYSTEMhive.