using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Data;
using System.Drawing;
using System.Text;
using System.Windows.Forms;
using Microsoft.Win32;
namespace USBforensic1
{
public partial class Form1 : Form
{
public Form1()
{
InitializeComponent();
}
private void button1_Click(object sender, EventArgs e)
{
RegistryKey USBConnKey;
USBConnKey = Registry.LocalMachine.OpenSubKey(@"SYSTEMCurrentControlSetEnumUSBSTOR", false);
foreach (string sub1 in USBConnKey.GetSubKeyNames())
{
RegistryKey sub1key = USBConnKey.OpenSubKey(sub1, false);
foreach (string sub2 in sub1key.GetSubKeyNames())
{
try
{
RegistryKey sub2key = sub1key.OpenSubKey(sub2, false);
if (sub2key.GetValue("Service", "").Equals("disk"))
{
String Path = "USBSTOR" + "\" + sub1 + "\" + sub2;
String Name = (string)sub2key.GetValue("FriendlyName", "");
richTextBox1.AppendText("USB名称 " + Name + "
");
richTextBox1.AppendText("UID标记 " + sub2 + "
");
richTextBox1.AppendText("路径信息 " + Path + "
");
}
}
catch (Exception msg)
{
MessageBox.Show(msg.Message);
}
}
}
}
}
}