using System; using System.Collections.Generic; using System.ComponentModel; using System.Data; using System.Drawing; using System.Text; using System.Windows.Forms; using Microsoft.Win32; namespace USBforensic1 { public partial class Form1 : Form { public Form1() { InitializeComponent(); } private void button1_Click(object sender, EventArgs e) { RegistryKey USBConnKey; USBConnKey = Registry.LocalMachine.OpenSubKey(@"SYSTEMCurrentControlSetEnumUSBSTOR", false); foreach (string sub1 in USBConnKey.GetSubKeyNames()) { RegistryKey sub1key = USBConnKey.OpenSubKey(sub1, false); foreach (string sub2 in sub1key.GetSubKeyNames()) { try { RegistryKey sub2key = sub1key.OpenSubKey(sub2, false); if (sub2key.GetValue("Service", "").Equals("disk")) { String Path = "USBSTOR" + "\" + sub1 + "\" + sub2; String Name = (string)sub2key.GetValue("FriendlyName", ""); richTextBox1.AppendText("USB名称 " + Name + " "); richTextBox1.AppendText("UID标记 " + sub2 + " "); richTextBox1.AppendText("路径信息 " + Path + " "); } } catch (Exception msg) { MessageBox.Show(msg.Message); } } } } } }