usbrip

usbrip is a forensic tool for Linux systems that tracks the complete history of USB device connections by parsing system log files and generating detailed reports of all USB events. It extracts device identifiers including vendor ID, product ID, serial number, manufacturer, and connection timestamps, storing them in a searchable database for historical analysis. Digital forensics investigators and incident responders use usbrip to determine which USB devices were connected to a system, when they were connected, and whether any unauthorized storage devices were used to exfiltrate data. The tool can generate violation reports by comparing connected devices against a whitelist of authorized USB hardware, and exports results in JSON format for integration with broader forensic analysis workflows.