usbrip
Security and privacy
forensics tool
SHOW HN2019
How HN took it
0 positive, 8 neutral or asking, 1 mixed, 4 critical, out of 13 comments about the project. Thread score -0.18.
Idea: 0 for, 3 againstExecution: 0 for, 1 against
The thread, comment by comment
Each row is a top-level comment and its replies, in HN's order. Select a cell to open that comment on HN.
positive neutral or mixed critical about another commenter or something else the maker
What HN said
What people liked
Looks interesting and useful as a forensics idea
From 2 comments
Looks interesting. Could you please convert the tabs to 4 spaces though?
LukeB42 on HNI like this. Is there a way to clean up the logs this uses to hide these traces? I didn't see any such functionality as I skimmed the README.
Lowkeyloki on HN
Objections
Log timestamps lack a year, so results are not forensically sound as full dates
From 3 comments
Question: From the screenshots it seems like no year is shown? Only month, day, time. It would be IMHO advisable to use not the name of the month and somehow fit in the line the…
jaclaz on HNWell, no, that is a non-explanation. If the format of syslogs doesn't change there should be no issues (or should it be read as "the system logs don't have the year"? ) If you…
jaclaz on HNWell, then the tool has no actual "forensics" use by itself. It's a pity, of course, but it can only be a tool to confirm findings that have a "proper" timestamp. Most probably…
jaclaz on HN
Parses only RFC 3164 syslog, breaking on rsyslog/syslog-ng format changes
From 3 comments
They explain the reason in README: ``` usbrip works with non-modified structure of system log files only, so, unfortunately, it won't be able to parse USB history if you change…
pretty_lorelei on HN> or should it be read as "the system logs don't have the year"? That's the case. RFC 3164, which specifies the log format, is the only one usbrip can read, and it doesn't have…
pretty_lorelei on HNWell that's unfortunate, I tend to be rather militant about switching my syslog to something resembling rfc 3339. linux /etc/rsyslog.conf $ActionFileDefaultTemplate…
somacert on HN
Requests
Use spaces instead of tabs in the code
From 1 comment
Looks interesting. Could you please convert the tabs to 4 spaces though?
LukeB42 on HN
Log cleanup functionality to hide traces
From 1 comment
I like this. Is there a way to clean up the logs this uses to hide these traces? I didn't see any such functionality as I skimmed the README.
Lowkeyloki on HN
Questions
Why not record udev events instead of parsing syslog
From 2 comments
Wouldn't this be more reliable by recording udev events instead of parsing the syslog?
MartijnBraam on HNI'm confused by this. Why can you not have udev events or the kernel API doing the same thing?
techntoke on HN
Alternatives named
Udev rules logging USB events to journald
From 2 comments
Yeah, here's a one-line udev rule to log USB removal and insertion into the journal. > $ echo 'SUBSYSTEMS=="block", RUN+="/usr/bin/logger --tag=block-device-history -- %E{ACTION}…
shasheene on HNSlightly tweaked the above, in case anyone is interested. Copy the following to /etc/udev/rules.d/10-block-device-history-rules: > SUBSYSTEM=="block",ENV{DEVTYPE}=="disk",…
shasheene on HN