using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Data;
using System.Drawing;
using System.Text;
using System.Windows.Forms;
using Microsoft.Win32;

namespace USBforensic1
{
    public partial class Form1 : Form
    {
        public Form1()
        {
            InitializeComponent();
        }

        private void button1_Click(object sender, EventArgs e)
        {
            RegistryKey USBConnKey;
            
            USBConnKey = Registry.LocalMachine.OpenSubKey(@"SYSTEM\CurrentControlSet\Enum\USBSTOR", false);
            foreach (string sub1 in USBConnKey.GetSubKeyNames())
            {
                RegistryKey sub1key = USBConnKey.OpenSubKey(sub1, false);
                foreach (string sub2 in sub1key.GetSubKeyNames())
                {
                    try
                    {
                        RegistryKey sub2key = sub1key.OpenSubKey(sub2, false);
                        if (sub2key.GetValue("Service", "").Equals("disk"))
                        {
                            String Path = "USBSTOR" + "\\" + sub1 + "\\" + sub2;
                            String Name = (string)sub2key.GetValue("FriendlyName", "");
                            richTextBox1.AppendText("USB名称  " + Name + "\r\n");
                            richTextBox1.AppendText("UID标记  " + sub2 + "\r\n");
                            richTextBox1.AppendText("路径信息 " + Path + "\r\n\r\n");
                        }
                    }
                    catch (Exception msg)
                    {
                        MessageBox.Show(msg.Message);
                    }
                }
            }
        }
    }
}