Module driver_framework 

Adapter: Microsoft-Windows-DriverFrameworks-UserMode/Operational event-log records → USB-history Claims.

The DriverFrameworks-UserMode (UMDF) Operational log tracks the user-mode driver host’s view of a device’s lifecycle. For a USB device the two forensically load-bearing records are the arrival (EID 2003, UMDFHostDeviceArrivalBegin) and the final removal (EID 2102, UMDFHostDeviceRequest), correlated by the device instance serial — the same key the registry Enum\{USB,USBSTOR} and Kernel-PnP records use. So a DriverFrameworks record is an event-log witness of a connect/disconnect at the record’s time, on a different tamper surface than the registry, and the correlation core grades agreement as corroborated. A pure mapping over already-decoded event JSON; the evtx reader (in the binary) does the .evtx parsing.

Field structure per two independent authoritative maps — Eric Zimmerman’s EvtxECmd map (.../DriverFrameworks-UserMode_2100.map, InstanceId under UserData/UMDFHostDeviceRequest) and IncideDigital rvt2 (instance/lifetime as attributes on the UserData child element). Real logs use the attribute form; the element form is handled defensively. EID 2003/2102 chosen as the clean connect/disconnect pair (2100/2101 are intermediate power ops — noise). The log is disabled by default on Win8+, so it is present only when an admin enabled it.

Structs

DriverFrameworkEvent

A decoded USB DriverFrameworks arrival/removal event.

DriverFrameworkSource

A HistorySource over decoded USB DriverFrameworks events.

Functions

driver_framework_events

Extract USB DriverFrameworks arrival/removal events from an iterator of evtx record JSON values (each the {"Event": {…}} object). Keeps only Microsoft-Windows-DriverFrameworks-UserMode records with EID 2003 or 2102 whose instance is a USB\ / USBSTOR\ device (root hubs and internal devices dropped).