Correlate Windows registry keys (USBSTOR, MountedDevices), Event Logs, and setupapi.dev.log to reconstruct USB device connection history, first/last-plugged timestamps, and drive letter mappings. Use when investigating removable media usage, tracking device provenance, or building a timeline for suspected data exfiltration.
Install
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-usb-device-connection-historynpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-usb-device-connection-history -a claude-code -gnpx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-usb-device-connection-history -a codex -ggemini skills install https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git --path skills/analyzing-usb-device-connection-historygh skill install mukul975/Anthropic-Cybersecurity-Skills analyzing-usb-device-connection-historygit clone --depth 1 https://github.com/mukul975/Anthropic-Cybersecurity-Skills /tmp/mukul975__Anthropic-Cybersecurity-Skills
mkdir -p ~/.claude/skills ~/.agents/skills
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/analyzing-usb-device-connection-history ~/.claude/skills/analyzing-usb-device-connection-history # Claude Code
cp -R /tmp/mukul975__Anthropic-Cybersecurity-Skills/skills/analyzing-usb-device-connection-history ~/.agents/skills/analyzing-usb-device-connection-history # Codex, Cursor, Gemini CLI, Copilot, OpenCode