[{"data":1,"prerenderedAt":235},["ShallowReactive",2],{"project-20524779":3},{"id":4,"name":5,"line":6,"line_source":7,"title":8,"url":9,"domain":10,"maker":11,"posted_at":12,"year":13,"points":14,"comments":15,"rank_in_year":16,"shown_in_year":17,"top":18,"tier":19,"category":20,"subcategory":21,"format":22,"keywords":23,"reception":28,"sentiment":29,"stance_mix":30,"scored_comments":35,"aspects":36,"strip":42,"post_text":43,"what":44,"said":62,"maker_in_thread":135,"shape":140,"grid":144,"attempts":196,"same_week":197,"maker_shows":33,"maker_hidden":227,"reader_version":228,"card":229},"20524779","usbrip","CLI forensics tool for tracking USB device artifacts on Linux","title","Show HN: CLI forensics tool for tracking USB device artifacts on Linux","https:\u002F\u002Fgithub.com\u002Fsnovvcrash\u002Fusbrip","github.com","snovvcrash",1564057817,2019,136,24,334,2195,16,"notable","security_privacy","forensics tool","cli",[24,25,26,27],"usb forensics","linux forensics","usb history","syslog parser","curious",-0.182,{"positive":31,"neutral":32,"mixed":33,"critical":34},0,8,1,4,13,{"design":37,"execution":38,"idea":39,"privacy":41},{"positive":31,"critical":31},{"positive":31,"critical":33},{"positive":31,"critical":40},3,{"positive":31,"critical":31},[40,40,33,40,33,31,31,33,40,31,40,40,40,33,40,40,31,31,31,31,31,31,31,31],null,{"problem":45,"audience":43,"pricing":43,"motivation":43,"time_to_build":43,"stack":51,"openness":60,"stage":61,"team_size":61},{"value":46,"source":47,"evidence":48},"Tracking USB device artifacts and history on Linux systems","maker",[49],{"id":50},"post",[52],{"value":53,"source":54,"evidence":55},"Python","commenter",[56],{"id":57,"by":58,"text":59},"20525613","kbanana","Python, which this program is written in, uses indentation for blocks. Mixing spaces and tabs is basically a syntax error.","open_source","unknown",{"praise":63,"objections":75,"requests":103,"questions":112,"alternatives":124},[64],{"value":65,"source":54,"evidence":66},"Looks interesting and useful as a forensics idea",[67,71],{"id":68,"by":69,"text":70},"20524868","LukeB42","Looks interesting. Could you please convert the tabs to 4 spaces though?",{"id":72,"by":73,"text":74},"20529937","Lowkeyloki","I like this. Is there a way to clean up the logs this uses to hide these traces? I didn't see any such functionality as I skimmed the README.",[76,89],{"value":77,"source":54,"evidence":78},"Log timestamps lack a year, so results are not forensically sound as full dates",[79,83,86],{"id":80,"by":81,"text":82},"20525635","jaclaz","Question: From the screenshots it seems like no year is shown? Only month, day, time. It would be IMHO advisable to use not the name of the month and somehow fit in the line the…",{"id":84,"by":81,"text":85},"20526431","Well, no, that is a non-explanation. If the format of syslogs doesn't change there should be no issues (or should it be read as \"the system logs don't have the year\"? ) If you…",{"id":87,"by":81,"text":88},"20533188","Well, then the tool has no actual \"forensics\" use by itself. It's a pity, of course, but it can only be a tool to confirm findings that have a \"proper\" timestamp. Most probably…",{"value":90,"source":54,"evidence":91},"Parses only RFC 3164 syslog, breaking on rsyslog\u002Fsyslog-ng format changes",[92,96,99],{"id":93,"by":94,"text":95},"20526306","pretty_lorelei","They explain the reason in README: ``` usbrip works with non-modified structure of system log files only, so, unfortunately, it won't be able to parse USB history if you change…",{"id":97,"by":94,"text":98},"20530808","> or should it be read as \"the system logs don't have the year\"? That's the case. RFC 3164, which specifies the log format, is the only one usbrip can read, and it doesn't have…",{"id":100,"by":101,"text":102},"20531075","somacert","Well that's unfortunate, I tend to be rather militant about switching my syslog to something resembling rfc 3339. linux \u002Fetc\u002Frsyslog.conf $ActionFileDefaultTemplate…",[104,108],{"value":105,"source":54,"evidence":106},"Use spaces instead of tabs in the code",[107],{"id":68,"by":69,"text":70},{"value":109,"source":54,"evidence":110},"Log cleanup functionality to hide traces",[111],{"id":72,"by":73,"text":74},[113],{"value":114,"source":54,"evidence":115},"Why not record udev events instead of parsing syslog",[116,120],{"id":117,"by":118,"text":119},"20524873","MartijnBraam","Wouldn't this be more reliable by recording udev events instead of parsing the syslog?",{"id":121,"by":122,"text":123},"20527809","techntoke","I'm confused by this. Why can you not have udev events or the kernel API doing the same thing?",[125],{"value":126,"source":54,"evidence":127},"Udev rules logging USB events to journald",[128,132],{"id":129,"by":130,"text":131},"20531146","shasheene","Yeah, here's a one-line udev rule to log USB removal and insertion into the journal. > $ echo 'SUBSYSTEMS==\"block\", RUN+=\"\u002Fusr\u002Fbin\u002Flogger --tag=block-device-history -- %E{ACTION}…",{"id":133,"by":130,"text":134},"20533985","Slightly tweaked the above, in case anyone is interested. Copy the following to \u002Fetc\u002Fudev\u002Frules.d\u002F10-block-device-history-rules: > SUBSYSTEM==\"block\",ENV{DEVTYPE}==\"disk\",…",{"comments":33,"answered":33,"key":136},[137],{"id":138,"text":139},"20524934","Yes, it is one of possible decisions but that would make the tool a bit less portable. When dealing with text logs, you can move them around as well as keep backup storages…",{"commenters":141,"max_depth":142,"maker_replies":33,"first_comment_mins":18,"lifespan_hours":143},19,5,23,[145,147,149,151,152,153,157,159,161,162,164,165,166,167,171,173,174,177,180,183,184,187,190,193],[80,31,40,146,81,31],"project\u002Fneutral\u002Fdesign",[93,31,40,148,94,31],"project\u002Fneutral\u002Fexecution",[84,31,33,150,81,31],"project\u002Fcritical\u002Fidea",[97,31,40,148,94,31],[87,31,33,150,81,31],[154,31,31,155,156,31],"20527297","commenter\u002Fneutral\u002Fnone","pitaj",[158,31,31,155,94,31],"20530772",[100,31,33,160,101,31],"project\u002Fcritical\u002Fexecution",[117,33,40,148,118,31],[138,33,31,163,11,33],"maker\u002Fneutral\u002Fexecution",[121,33,40,163,122,31],[129,33,40,148,130,31],[133,33,40,148,130,31],[168,169,33,150,170,31],"20525612",2,"ape4",[72,40,40,172,73,31],"project\u002Fmixed\u002Fprivacy",[68,34,40,148,69,31],[175,34,31,155,176,31],"20524933","SahAssar",[178,34,31,155,179,31],"20524983","crb",[181,34,31,155,182,31],"20525415","simion314",[57,34,31,155,58,31],[185,34,31,155,186,31],"20525762","giancarlostoro",[188,34,31,155,189,31],"20529626","joepie91_",[191,34,31,155,192,31],"20526408","saagarjha",[194,34,31,155,195,31],"20526146","GrumpyNl",[],[198,203,208,213,217,222],{"id":199,"name":200,"points":201,"category":202},"20533318","Sauron-native",255,"languages",{"id":204,"name":205,"points":206,"category":207},"20546356","TLDR This",235,"productivity",{"id":209,"name":210,"points":211,"category":212},"20550167","Memorize Terminal Commands",166,"learning_science",{"id":214,"name":215,"points":216,"category":202},"20563970","Bild",138,{"id":218,"name":219,"points":220,"category":221},"20569337","Builder.io",109,"web_saas",{"id":223,"name":224,"points":225,"category":226},"20531307","jokenpo",101,"ai",false,"v2",{"id":230,"name":5,"line":6,"ai":227,"cat":20,"year":13,"points":14,"comments":15,"rec":28,"s":231,"top":18,"kw":232,"maker":11,"domain":10,"tier":19,"attempts":31,"strip":233,"url":9,"mix":234,"praise":65,"objection":77,"sub":21},20524779,-0.18,[24,25,26,27],"331310013033313300000000",[31,32,33,34],1793990992018]