{"id":6072,"date":"2019-08-05T16:44:08","date_gmt":"2019-08-05T11:14:08","guid":{"rendered":"http:\/\/kalilinuxtutorials.com\/?p=6072"},"modified":"2019-08-05T16:44:08","modified_gmt":"2019-08-05T11:14:08","slug":"usbrip-simple-cli-forensics","status":"publish","type":"post","link":"https:\/\/kalilinuxtutorials.com\/usbrip-simple-cli-forensics\/","title":{"rendered":"Usbrip : Simple CLI Forensics Tool For Tracking USB Device Artifacts"},"content":{"rendered":"\n<p><strong>Usbrip<\/strong> (derived from &#8220;USB Ripper&#8221;, not &#8220;USB R.I.P.&#8221; astonished) is an open source forensics tool with CLI interface that lets you keep track of USB device artifacts (aka USB event history, &#8220;Connected&#8221; and &#8220;Disconnected&#8221; events) on Linux machines.<\/p>\n\n\n\n<p>It is a small piece of software written in pure Python 3 (using some external modules though, see <a href=\"https:\/\/github.com\/snovvcrash\/usbrip#pip-packages\">Dependencies\/PIP<\/a>) which parses Linux log files (<code><strong>\/var\/log\/syslog*<\/strong><\/code><strong> or <\/strong><code><strong>\/var\/log\/messages*<\/strong><\/code>  depending on the distro) for constructing USB event history tables.  <\/p>\n\n\n\n<p>Such tables may contain the following columns: &#8220;<strong>Connected&#8221; (date &amp;  time), &#8220;User&#8221;, &#8220;VID&#8221; (vendor ID), &#8220;PID&#8221; (product ID), &#8220;Product&#8221;,  &#8220;Manufacturer&#8221;, &#8220;Serial Number&#8221;, &#8220;Port&#8221; and &#8220;Disconnected&#8221; (date &amp;  time)<\/strong>.<\/p>\n\n\n\n<p>Besides, it also can:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>export gathered information as a JSON dump (and open such dumps, of course);<\/li><li>generate a list of authorized (<em>trusted<\/em>) USB devices as a JSON (call it <code>auth.json<\/code>);<\/li><li>search for &#8220;violation events&#8221; based on the <code>auth.json<\/code>: show (or generate another JSON with) USB devices that do appear in history and do NOT appear in the <code>auth.json<\/code>;<\/li><li><em>*when installed with <code>-s<\/code> flag*<\/em> create crypted storages (7zip archives) to automatically backup and accumulate USB events with the help of <code>crontab<\/code> scheduler;<\/li><li>search additional details about a specific USB device based on its VID and\/or PID.<\/li><\/ul>\n\n\n\n<p style=\"text-align:center\"><strong>Also Read &#8211; <a href=\"https:\/\/kalilinuxtutorials.com\/python-uncompyle6\/\" target=\"_blank\" rel=\"noreferrer noopener\" aria-label=\"Python Uncompyle6 \u2013 A Cross-Version Python Bytecode Decompiler (opens in a new tab)\">Python Uncompyle6 \u2013 A Cross-Version Python Bytecode Decompiler<\/a><\/strong><\/p>\n\n\n\n<h1 class=\"wp-block-heading\"><a href=\"https:\/\/github.com\/snovvcrash\/usbrip#quick-start\"><\/a><\/h1>\n\n\n\n<p style=\"text-align:center\" class=\"has-background has-light-green-cyan-background-color\"><strong>Quick Start<\/strong><\/p>\n\n\n\n<p>usbrip is available for download and installation at <a href=\"https:\/\/pypi.org\/project\/usbrip\/\">PyPI<\/a>:<\/p>\n\n\n\n<p class=\"has-text-color has-background has-vivid-green-cyan-color has-very-dark-gray-background-color\"><strong>$ pip3 install usbrip<\/strong><\/p>\n\n\n\n<p style=\"text-align:center\" class=\"has-background has-light-green-cyan-background-color\"><strong>Git Clone<\/strong><\/p>\n\n\n\n<p>For simplicity, lets agree that all the commands where <code>~\/usbrip$<\/code> prefix is appeared are executed in the <code>~\/usbrip<\/code> directory which is created as a result of git clone:<\/p>\n\n\n\n<p class=\"has-text-color has-background has-vivid-green-cyan-color has-very-dark-gray-background-color\"><strong>~$ git clone https:\/\/github.com\/snovvcrash\/usbrip.git usbrip &amp;&amp; cd usbrip <\/strong><br><strong>~\/usbrip$ <\/strong><\/p>\n\n\n\n<h1 class=\"wp-block-heading\"><a href=\"https:\/\/github.com\/snovvcrash\/usbrip#dependencies\"><\/a><\/h1>\n\n\n\n<p style=\"text-align:center\" class=\"has-background has-light-green-cyan-background-color\"><strong>Dependencies<\/strong><\/p>\n\n\n\n<p>usbrip works with <strong>non<\/strong>-modified structure of system \nlog files only, so, unfortunately, it won&#8217;t be able to parse USB history\n if you change the format of syslogs (with <code>syslog-ng<\/code> or <code>rsyslog<\/code>,\n for example). That&#8217;s why the timestamps of &#8220;Connected&#8221; and \n&#8220;Disconnected&#8221; fields don&#8217;t have the year, by the way. Keep that in \nmind.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><a href=\"https:\/\/github.com\/snovvcrash\/usbrip#deb-packages\"><\/a><\/h2>\n\n\n\n<p style=\"text-align:center\" class=\"has-background has-light-green-cyan-background-color\"><strong>DEB Packages<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>python3.6 (or newer) interpreter<\/li><li>python3-venv<\/li><li>p7zip-full (used by <code>storages<\/code> module)<\/li><\/ul>\n\n\n\n<p class=\"has-text-color has-background has-vivid-green-cyan-color has-very-dark-gray-background-color\"><strong>~$ sudo apt install python3-venv p7zip-full -y <\/strong><\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><a href=\"https:\/\/github.com\/snovvcrash\/usbrip#pip-packages\"><\/a><\/h2>\n\n\n\n<p style=\"text-align:center\" class=\"has-background has-light-green-cyan-background-color\"><strong>PIP Packages<\/strong><\/p>\n\n\n\n<p>usbrip makes use of the following external modules:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li><a href=\"https:\/\/github.com\/Robpol86\/terminaltables\">terminaltables<\/a><\/li><li><a href=\"https:\/\/pypi.org\/project\/termcolor\">termcolor<\/a><\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\"><a href=\"https:\/\/github.com\/snovvcrash\/usbrip#portable\"><\/a><\/h2>\n\n\n\n<p style=\"text-align:center\" class=\"has-background has-light-green-cyan-background-color\"><strong>Portable<\/strong><\/p>\n\n\n\n<p>To resolve Python dependencies manually (it&#8217;s not necessary actually because <code>pip<\/code> or <code>setup.py<\/code> can automate the process, see <a href=\"https:\/\/github.com\/snovvcrash\/usbrip#installation\">Installation<\/a>) create a <em>virtual environment<\/em> (optional) and run <code>pip<\/code> from within:<\/p>\n\n\n\n<p class=\"has-text-color has-background has-vivid-green-cyan-color has-very-dark-gray-background-color\">~\/usbrip$ python3 -m venv venv &amp;&amp; source venv\/bin\/activate\n(venv) ~\/usbrip$ pip install -r requirements.txt\n<\/p>\n\n\n\n<p>Or let the <a href=\"https:\/\/github.com\/pypa\/pipenv\"><code><strong>pipenv<\/strong><\/code><\/a> one-liner do all the dirty work for you:<\/p>\n\n\n\n<p class=\"has-text-color has-background has-vivid-green-cyan-color has-very-dark-gray-background-color\">~\/usbrip$ pipenv install &amp;&amp; pipenv shell\n<\/p>\n\n\n\n<p>After that you can run usbrip portably:<\/p>\n\n\n\n<p class=\"has-text-color has-background has-vivid-green-cyan-color has-very-dark-gray-background-color\"><strong>(venv) ~\/usbrip$ python -m usbrip -h <br>Or <br>(venv) ~\/usbrip$ python __main__.py -h <\/strong><\/p>\n\n\n\n<h1 class=\"wp-block-heading\"><a href=\"https:\/\/github.com\/snovvcrash\/usbrip#installation\"><\/a><\/h1>\n\n\n\n<p style=\"text-align:center\" class=\"has-background has-light-green-cyan-background-color\"><strong>Installation<\/strong><\/p>\n\n\n\n<p>There are two ways to install usbrip into the system: <code><strong>pip<\/strong><\/code><strong> <\/strong>or <code><strong>setup.py<\/strong><\/code>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><a href=\"https:\/\/github.com\/snovvcrash\/usbrip#pip-or-setuppy\"><\/a><\/h2>\n\n\n\n<p class=\"has-text-color has-background has-vivid-green-cyan-color has-very-dark-gray-background-color\"><strong>pip or setup.py <\/strong><\/p>\n\n\n\n<p>First of all, usbrip is pip installable. This means that after git \ncloning the repo you can simply fire up the pip installation process and\n after that run usbrip from anywhere in your terminal like so:<\/p>\n\n\n\n<p class=\"has-text-color has-background has-vivid-green-cyan-color has-very-dark-gray-background-color\">~\/usbrip$ python3 -m venv venv &amp;&amp; source venv\/bin\/activate (venv) ~\/usbrip$ pip install . <br><br>(venv) ~\/usbrip$ usbrip -h <\/p>\n\n\n\n<p>Or if you want to resolve Python dependencies locally (without bothering PyPI), use <code><strong>setup.py<\/strong><\/code>:<\/p>\n\n\n\n<p class=\"has-text-color has-background has-vivid-green-cyan-color has-very-dark-gray-background-color\">~\/usbrip$ python3 -m venv venv &amp;&amp; source venv\/bin\/activate (venv) ~\/usbrip$ python setup.py install <br><br>(venv) ~\/usbrip$ usbrip -h <\/p>\n\n\n\n<p> <strong>Note<\/strong>: you&#8217;d likely want to run the installation process while the Python virtual environment is active (like it is shown above).<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><a href=\"https:\/\/github.com\/snovvcrash\/usbrip#installsh\"><\/a><\/h2>\n\n\n\n<p style=\"text-align:center\" class=\"has-background has-light-green-cyan-background-color\"><strong>install.sh<\/strong><\/p>\n\n\n\n<p>Secondly, usbrip can also be installed into the system with the <code><strong>.\/installers\/install.sh<\/strong><\/code> script.<\/p>\n\n\n\n<p>When using the <code><strong>.\/installers\/install.sh<\/strong><\/code> some extra features become available:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>the virtual environment is created automatically;<\/li><li>the <code><strong>storage<\/strong><\/code> module becomes available: you can set a  crontab job to backup USB events on a schedule (the example of crontab  jobs can be found in <code><strong>usbrip\/cron\/usbrip.cron<\/strong><\/code>).<\/li><\/ul>\n\n\n\n<p> <strong>Warning<\/strong>: if you are using the crontab scheduling, you want to configure the cron job with <code><strong>sudo crontab -e<\/strong><\/code> in order to force the <code><strong>storage update<\/strong><\/code> submodule run as root as well as protect the passwords of the USB event storages. The storage passwords are kept in <code><strong>\/var\/opt\/usbrip\/usbrip.ini<\/strong><\/code><strong>.<\/strong><\/p>\n\n\n\n<p>The <code><strong>.\/installers\/uninstall.sh<\/strong><\/code> script removes all the installation artifacts from your system.<\/p>\n\n\n\n<p>To install usbrip use:<\/p>\n\n\n\n<p class=\"has-text-color has-background has-vivid-green-cyan-color has-very-dark-gray-background-color\">~\/usbrip$ chmod +x .\/installers\/install.sh <br>~\/usbrip$ sudo -H .\/installers\/install.sh [-l\/&#8211;local] [-s\/&#8211;storages] <br>~\/usbrip$ cd <br><br>~$ usbrip -h <\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>When <code><strong>-l<\/strong><\/code> switch is enabled, Python dependencies are resolved from local .tar packages (<code><strong>.\/3rdPartyTools\/<\/strong><\/code>) instead of PyPI.<\/li><li>When <code><strong>-s<\/strong><\/code> switch is enabled, not only the usbrip project  is installed, but also the list of trusted USB devices, history and  violations storages are created.<\/li><\/ul>\n\n\n\n<p> <strong>Note<\/strong>: when using <code>-s<\/code> option during installation, make sure that system logs do contain at least one <em>external<\/em>\n USB device entry. It is a necessary condition for usbrip to \nsuccessfully create the list of trusted devices (and as a result, \nsuccessfully create the violations storage).<\/p>\n\n\n\n<p>After the installation completes, feel free to remove the usbrip folder.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><a href=\"https:\/\/github.com\/snovvcrash\/usbrip#paths\"><\/a><\/h3>\n\n\n\n<p style=\"text-align:center\" class=\"has-background has-light-green-cyan-background-color\"><strong>Paths<\/strong><\/p>\n\n\n\n<p>When installed, the usbrip uses the following paths:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li><code><strong>\/opt\/usbrip\/<\/strong><\/code> \u2014 project&#8217;s main directory;<\/li><li><code><strong>\/var\/opt\/usbrip\/usbrip.ini<\/strong><\/code> \u2014 usbrip configuration file: keeps passwords for 7zip storages;<\/li><li><code><strong>\/var\/opt\/usbrip\/storage\/<\/strong><\/code> \u2014 USB event storages: <code><strong>history.7z<\/strong><\/code> and <code><strong>violations.7z<\/strong><\/code> (created during the installation process);<\/li><li><code><strong>\/var\/opt\/usbrip\/log\/<\/strong><\/code> \u2014 usbrip logs (recommended to log usbrip activity when using crontab, see <code><strong>usbrip\/cron\/usbrip.cron<\/strong><\/code>);<\/li><li><code><strong>\/var\/opt\/usbrip\/trusted\/<\/strong><\/code> \u2014 list of trusted USB devices (created during the installation process);<\/li><li><code><strong>\/usr\/local\/bin\/usbrip<\/strong><\/code> \u2014 symlink to the <code><strong>\/opt\/usbrip\/venv\/bin\/usbrip<\/strong><\/code> script.<\/li><\/ul>\n\n\n\n<h3 class=\"wp-block-heading\"><a href=\"https:\/\/github.com\/snovvcrash\/usbrip#cron\"><\/a><\/h3>\n\n\n\n<p style=\"text-align:center\" class=\"has-background has-light-green-cyan-background-color\"><strong>Cron<\/strong><\/p>\n\n\n\n<p>Cron jobs can be set as follows:<\/p>\n\n\n\n<p class=\"has-text-color has-background has-vivid-green-cyan-color has-very-dark-gray-background-color\">~\/usbrip$ sudo crontab -l &gt; tmpcron &amp;&amp; echo &#8220;&#8221; &gt;&gt; tmpcron <br>~\/usbrip$ cat usbrip\/cron\/usbrip.cron | tee -a tmpcron <br>~\/usbrip$ sudo crontab tmpcron <br>~\/usbrip$ rm tmpcron <\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><a href=\"https:\/\/github.com\/snovvcrash\/usbrip#uninstallsh\"><\/a><\/h3>\n\n\n\n<p style=\"text-align:center\" class=\"has-background has-light-green-cyan-background-color\"><strong>uninstall.sh <\/strong><\/p>\n\n\n\n<p>To uninstall usbrip use:<\/p>\n\n\n\n<p class=\"has-text-color has-background has-vivid-green-cyan-color has-very-dark-gray-background-color\">~\/usbrip$ chmod +x .\/installers\/uninstall.sh <br>~\/usbrip$ sudo .\/installers\/uninstall.sh [-a\/&#8211;all] <\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>When <code>-a<\/code> switch is enabled, not only the usbrip project directory is deleted, but also all the storages and usbrip logs are deleted too.<\/li><\/ul>\n\n\n\n<p>And don&#8217;t forget to remove the cron job.<\/p>\n\n\n\n<p style=\"text-align:center\" class=\"has-background has-light-green-cyan-background-color\"><strong>Screenshots<\/strong><\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/1.bp.blogspot.com\/-RUzmQiX6w_Q\/XUaFhBt-QzI\/AAAAAAAABrE\/Vs4VSmNtUDwzX1bSBTqlIVC5U3BsJUUWQCLcBGAs\/s1600\/Screenshots-1.png\" alt=\"\"\/><\/figure>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter\"><img decoding=\"async\" src=\"https:\/\/1.bp.blogspot.com\/-e9hHlPcP5iw\/XUaFgwmErHI\/AAAAAAAABq8\/2v2pYSKRhyUjwDgtnFLCr_wfYrr_noVnQCLcBGAs\/s1600\/Screenshots-2.png\" alt=\"\"\/><\/figure><\/div>\n\n\n\n<div class=\"wp-block-button aligncenter is-style-squared\"><a class=\"wp-block-button__link has-background has-vivid-cyan-blue-background-color\" href=\"https:\/\/github.com\/snovvcrash\/usbrip\"><strong>Download<\/strong><\/a><\/div>\n","protected":false},"excerpt":{"rendered":"<p>Usbrip (derived from &#8220;USB Ripper&#8221;, not &#8220;USB R.I.P.&#8221; astonished) is an open source forensics tool with CLI interface that lets you keep track of USB device artifacts (aka USB event history, &#8220;Connected&#8221; and &#8220;Disconnected&#8221; events) on Linux machines. It is a small piece of software written in pure Python 3 (using some external modules though, [&hellip;]<\/p>\n","protected":false},"author":4,"featured_media":15724,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/1.bp.blogspot.com\/-OCrzPfBc90Y\/XUaFhOxY4CI\/AAAAAAAABrA\/eHc8OPFGfnU-aK5UIVeENDtLyAQTDSzUACLcBGAs\/s1600\/Screenshots-3.png","fifu_image_alt":"Usbrip : Simple CLI Forensics Tool For Tracking USB Device Artifacts","_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[28],"tags":[242,580,3490,3491,3492],"class_list":["post-6072","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-kali","tag-artifacts","tag-cli-forensics","tag-usb","tag-usb-device","tag-usbrip"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.0 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Usbrip : Simple CLI Forensics Tool For Tracking USB Device Artifacts<\/title>\n<meta name=\"description\" content=\"Usbrip (derived from &quot;USB Ripper&quot;, not &quot;USB R.I.P.&quot; astonished) is an open source forensics tool with CLI interface that lets you keep track of USB\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/kalilinuxtutorials.com\/usbrip-simple-cli-forensics\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Usbrip : Simple CLI Forensics Tool For Tracking USB Device Artifacts\" \/>\n<meta property=\"og:description\" content=\"Usbrip (derived from &quot;USB Ripper&quot;, not &quot;USB R.I.P.&quot; astonished) is an open source forensics tool with CLI interface that lets you keep track of USB\" \/>\n<meta property=\"og:url\" content=\"https:\/\/kalilinuxtutorials.com\/usbrip-simple-cli-forensics\/\" \/>\n<meta property=\"og:site_name\" content=\"Kali Linux Tutorials\" \/>\n<meta property=\"article:published_time\" content=\"2019-08-05T11:14:08+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/1.bp.blogspot.com\/-OCrzPfBc90Y\/XUaFhOxY4CI\/AAAAAAAABrA\/eHc8OPFGfnU-aK5UIVeENDtLyAQTDSzUACLcBGAs\/s1600\/Screenshots-3.png\" \/>\n<meta name=\"author\" content=\"R K\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:image\" content=\"https:\/\/1.bp.blogspot.com\/-OCrzPfBc90Y\/XUaFhOxY4CI\/AAAAAAAABrA\/eHc8OPFGfnU-aK5UIVeENDtLyAQTDSzUACLcBGAs\/s1600\/Screenshots-3.png\" \/>\n<meta name=\"twitter:creator\" content=\"@CyberEdition\" \/>\n<meta name=\"twitter:site\" content=\"@CyberEdition\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"R K\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/kalilinuxtutorials.com\/usbrip-simple-cli-forensics\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/kalilinuxtutorials.com\/usbrip-simple-cli-forensics\/\"},\"author\":{\"name\":\"R K\",\"@id\":\"https:\/\/kalilinuxtutorials.com\/#\/schema\/person\/69444b58b9e267a4cf08fceb34b6f6ad\"},\"headline\":\"Usbrip : Simple CLI Forensics Tool For Tracking USB Device Artifacts\",\"datePublished\":\"2019-08-05T11:14:08+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/kalilinuxtutorials.com\/usbrip-simple-cli-forensics\/\"},\"wordCount\":939,\"publisher\":{\"@id\":\"https:\/\/kalilinuxtutorials.com\/#organization\"},\"image\":{\"@id\":\"https:\/\/kalilinuxtutorials.com\/usbrip-simple-cli-forensics\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/1.bp.blogspot.com\/-OCrzPfBc90Y\/XUaFhOxY4CI\/AAAAAAAABrA\/eHc8OPFGfnU-aK5UIVeENDtLyAQTDSzUACLcBGAs\/s1600\/Screenshots-3.png\",\"keywords\":[\"Artifacts\",\"CLI Forensics\",\"USB\",\"USB Device\",\"Usbrip\"],\"articleSection\":[\"Kali Linux\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/kalilinuxtutorials.com\/usbrip-simple-cli-forensics\/\",\"url\":\"https:\/\/kalilinuxtutorials.com\/usbrip-simple-cli-forensics\/\",\"name\":\"Usbrip : Simple CLI Forensics Tool For Tracking USB Device Artifacts\",\"isPartOf\":{\"@id\":\"https:\/\/kalilinuxtutorials.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/kalilinuxtutorials.com\/usbrip-simple-cli-forensics\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/kalilinuxtutorials.com\/usbrip-simple-cli-forensics\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/1.bp.blogspot.com\/-OCrzPfBc90Y\/XUaFhOxY4CI\/AAAAAAAABrA\/eHc8OPFGfnU-aK5UIVeENDtLyAQTDSzUACLcBGAs\/s1600\/Screenshots-3.png\",\"datePublished\":\"2019-08-05T11:14:08+00:00\",\"description\":\"Usbrip (derived from \\\"USB Ripper\\\", not \\\"USB R.I.P.\\\" astonished) is an open source forensics tool with CLI interface that lets you keep track of USB\",\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/kalilinuxtutorials.com\/usbrip-simple-cli-forensics\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/kalilinuxtutorials.com\/usbrip-simple-cli-forensics\/#primaryimage\",\"url\":\"https:\/\/1.bp.blogspot.com\/-OCrzPfBc90Y\/XUaFhOxY4CI\/AAAAAAAABrA\/eHc8OPFGfnU-aK5UIVeENDtLyAQTDSzUACLcBGAs\/s1600\/Screenshots-3.png\",\"contentUrl\":\"https:\/\/1.bp.blogspot.com\/-OCrzPfBc90Y\/XUaFhOxY4CI\/AAAAAAAABrA\/eHc8OPFGfnU-aK5UIVeENDtLyAQTDSzUACLcBGAs\/s1600\/Screenshots-3.png\"},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/kalilinuxtutorials.com\/#website\",\"url\":\"https:\/\/kalilinuxtutorials.com\/\",\"name\":\"Kali Linux Tutorials\",\"description\":\"Kali Linux Tutorials\",\"publisher\":{\"@id\":\"https:\/\/kalilinuxtutorials.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/kalilinuxtutorials.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/kalilinuxtutorials.com\/#organization\",\"name\":\"Kali Linux Tutorials\",\"url\":\"https:\/\/kalilinuxtutorials.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/kalilinuxtutorials.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/kalilinuxtutorials.com\/wp-content\/uploads\/2025\/07\/Kali.png\",\"contentUrl\":\"https:\/\/kalilinuxtutorials.com\/wp-content\/uploads\/2025\/07\/Kali.png\",\"width\":272,\"height\":90,\"caption\":\"Kali Linux Tutorials\"},\"image\":{\"@id\":\"https:\/\/kalilinuxtutorials.com\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/x.com\/CyberEdition\",\"https:\/\/www.threads.com\/@cybersecurityedition\",\"https:\/\/www.linkedin.com\/company\/cyberedition\",\"https:\/\/www.instagram.com\/cybersecurityedition\/\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/kalilinuxtutorials.com\/#\/schema\/person\/69444b58b9e267a4cf08fceb34b6f6ad\",\"name\":\"R K\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/kalilinuxtutorials.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/d3937c9687f2da11bc0a716404ff91779fe19ca115208dbf66167ad353aca5aa?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/d3937c9687f2da11bc0a716404ff91779fe19ca115208dbf66167ad353aca5aa?s=96&d=mm&r=g\",\"caption\":\"R K\"},\"url\":\"https:\/\/kalilinuxtutorials.com\/author\/ranjith\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Usbrip : Simple CLI Forensics Tool For Tracking USB Device Artifacts","description":"Usbrip (derived from \"USB Ripper\", not \"USB R.I.P.\" astonished) is an open source forensics tool with CLI interface that lets you keep track of USB","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/kalilinuxtutorials.com\/usbrip-simple-cli-forensics\/","og_locale":"en_US","og_type":"article","og_title":"Usbrip : Simple CLI Forensics Tool For Tracking USB Device Artifacts","og_description":"Usbrip (derived from \"USB Ripper\", not \"USB R.I.P.\" astonished) is an open source forensics tool with CLI interface that lets you keep track of USB","og_url":"https:\/\/kalilinuxtutorials.com\/usbrip-simple-cli-forensics\/","og_site_name":"Kali Linux Tutorials","article_published_time":"2019-08-05T11:14:08+00:00","og_image":[{"url":"https:\/\/1.bp.blogspot.com\/-OCrzPfBc90Y\/XUaFhOxY4CI\/AAAAAAAABrA\/eHc8OPFGfnU-aK5UIVeENDtLyAQTDSzUACLcBGAs\/s1600\/Screenshots-3.png","type":"","width":"","height":""}],"author":"R K","twitter_card":"summary_large_image","twitter_image":"https:\/\/1.bp.blogspot.com\/-OCrzPfBc90Y\/XUaFhOxY4CI\/AAAAAAAABrA\/eHc8OPFGfnU-aK5UIVeENDtLyAQTDSzUACLcBGAs\/s1600\/Screenshots-3.png","twitter_creator":"@CyberEdition","twitter_site":"@CyberEdition","twitter_misc":{"Written by":"R K","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/kalilinuxtutorials.com\/usbrip-simple-cli-forensics\/#article","isPartOf":{"@id":"https:\/\/kalilinuxtutorials.com\/usbrip-simple-cli-forensics\/"},"author":{"name":"R K","@id":"https:\/\/kalilinuxtutorials.com\/#\/schema\/person\/69444b58b9e267a4cf08fceb34b6f6ad"},"headline":"Usbrip : Simple CLI Forensics Tool For Tracking USB Device Artifacts","datePublished":"2019-08-05T11:14:08+00:00","mainEntityOfPage":{"@id":"https:\/\/kalilinuxtutorials.com\/usbrip-simple-cli-forensics\/"},"wordCount":939,"publisher":{"@id":"https:\/\/kalilinuxtutorials.com\/#organization"},"image":{"@id":"https:\/\/kalilinuxtutorials.com\/usbrip-simple-cli-forensics\/#primaryimage"},"thumbnailUrl":"https:\/\/1.bp.blogspot.com\/-OCrzPfBc90Y\/XUaFhOxY4CI\/AAAAAAAABrA\/eHc8OPFGfnU-aK5UIVeENDtLyAQTDSzUACLcBGAs\/s1600\/Screenshots-3.png","keywords":["Artifacts","CLI Forensics","USB","USB Device","Usbrip"],"articleSection":["Kali Linux"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/kalilinuxtutorials.com\/usbrip-simple-cli-forensics\/","url":"https:\/\/kalilinuxtutorials.com\/usbrip-simple-cli-forensics\/","name":"Usbrip : Simple CLI Forensics Tool For Tracking USB Device Artifacts","isPartOf":{"@id":"https:\/\/kalilinuxtutorials.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/kalilinuxtutorials.com\/usbrip-simple-cli-forensics\/#primaryimage"},"image":{"@id":"https:\/\/kalilinuxtutorials.com\/usbrip-simple-cli-forensics\/#primaryimage"},"thumbnailUrl":"https:\/\/1.bp.blogspot.com\/-OCrzPfBc90Y\/XUaFhOxY4CI\/AAAAAAAABrA\/eHc8OPFGfnU-aK5UIVeENDtLyAQTDSzUACLcBGAs\/s1600\/Screenshots-3.png","datePublished":"2019-08-05T11:14:08+00:00","description":"Usbrip (derived from \"USB Ripper\", not \"USB R.I.P.\" astonished) is an open source forensics tool with CLI interface that lets you keep track of USB","inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/kalilinuxtutorials.com\/usbrip-simple-cli-forensics\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/kalilinuxtutorials.com\/usbrip-simple-cli-forensics\/#primaryimage","url":"https:\/\/1.bp.blogspot.com\/-OCrzPfBc90Y\/XUaFhOxY4CI\/AAAAAAAABrA\/eHc8OPFGfnU-aK5UIVeENDtLyAQTDSzUACLcBGAs\/s1600\/Screenshots-3.png","contentUrl":"https:\/\/1.bp.blogspot.com\/-OCrzPfBc90Y\/XUaFhOxY4CI\/AAAAAAAABrA\/eHc8OPFGfnU-aK5UIVeENDtLyAQTDSzUACLcBGAs\/s1600\/Screenshots-3.png"},{"@type":"WebSite","@id":"https:\/\/kalilinuxtutorials.com\/#website","url":"https:\/\/kalilinuxtutorials.com\/","name":"Kali Linux Tutorials","description":"Kali Linux Tutorials","publisher":{"@id":"https:\/\/kalilinuxtutorials.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/kalilinuxtutorials.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/kalilinuxtutorials.com\/#organization","name":"Kali Linux Tutorials","url":"https:\/\/kalilinuxtutorials.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/kalilinuxtutorials.com\/#\/schema\/logo\/image\/","url":"https:\/\/kalilinuxtutorials.com\/wp-content\/uploads\/2025\/07\/Kali.png","contentUrl":"https:\/\/kalilinuxtutorials.com\/wp-content\/uploads\/2025\/07\/Kali.png","width":272,"height":90,"caption":"Kali Linux Tutorials"},"image":{"@id":"https:\/\/kalilinuxtutorials.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/CyberEdition","https:\/\/www.threads.com\/@cybersecurityedition","https:\/\/www.linkedin.com\/company\/cyberedition","https:\/\/www.instagram.com\/cybersecurityedition\/"]},{"@type":"Person","@id":"https:\/\/kalilinuxtutorials.com\/#\/schema\/person\/69444b58b9e267a4cf08fceb34b6f6ad","name":"R K","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/kalilinuxtutorials.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/d3937c9687f2da11bc0a716404ff91779fe19ca115208dbf66167ad353aca5aa?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/d3937c9687f2da11bc0a716404ff91779fe19ca115208dbf66167ad353aca5aa?s=96&d=mm&r=g","caption":"R K"},"url":"https:\/\/kalilinuxtutorials.com\/author\/ranjith\/"}]}},"jetpack_featured_media_url":"https:\/\/1.bp.blogspot.com\/-OCrzPfBc90Y\/XUaFhOxY4CI\/AAAAAAAABrA\/eHc8OPFGfnU-aK5UIVeENDtLyAQTDSzUACLcBGAs\/s1600\/Screenshots-3.png","jetpack_sharing_enabled":true,"jetpack-related-posts":[{"id":15477,"url":"https:\/\/kalilinuxtutorials.com\/csirt-collect\/","url_meta":{"origin":6072,"position":0},"title":"CSIRT-Collect : PowerShell Script To Collect Memory And (Triage) Disk Forensics","author":"R K","date":"August 31, 2021","format":false,"excerpt":"CSIRT-Collect is a PowerShell script to collect memory and (triage) disk forensics for incident response investigations. The script leverages a network share, from which it will access and copy the required executables and subsequently upload the acquired evidence to the same share post-collection. Permission requirements for said directory will be\u2026","rel":"","context":"In &quot;Kali Linux&quot;","block_context":{"text":"Kali Linux","link":"https:\/\/kalilinuxtutorials.com\/category\/kali\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/1.bp.blogspot.com\/-liQxT_Vh6_E\/YSclQkyhZ5I\/AAAAAAAAKko\/zB-T2m3rHp4MF5eFDaOhPhSH81BKse6VgCLcBGAsYHQ\/s728\/Disk%2BForensics.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/1.bp.blogspot.com\/-liQxT_Vh6_E\/YSclQkyhZ5I\/AAAAAAAAKko\/zB-T2m3rHp4MF5eFDaOhPhSH81BKse6VgCLcBGAsYHQ\/s728\/Disk%2BForensics.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/1.bp.blogspot.com\/-liQxT_Vh6_E\/YSclQkyhZ5I\/AAAAAAAAKko\/zB-T2m3rHp4MF5eFDaOhPhSH81BKse6VgCLcBGAsYHQ\/s728\/Disk%2BForensics.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/1.bp.blogspot.com\/-liQxT_Vh6_E\/YSclQkyhZ5I\/AAAAAAAAKko\/zB-T2m3rHp4MF5eFDaOhPhSH81BKse6VgCLcBGAsYHQ\/s728\/Disk%2BForensics.png?resize=700%2C400&ssl=1 2x"},"classes":[]},{"id":17449,"url":"https:\/\/kalilinuxtutorials.com\/csirt-collect-2\/","url_meta":{"origin":6072,"position":1},"title":"CSIRT-Collect : PowerShell Script To Collect Memory And (Triage) Disk Forensics","author":"R K","date":"August 6, 2021","format":false,"excerpt":"CSIRT-Collect is a PowerShell script to collect memory and (triage) disk forensics for incident response investigations. The script leverages a network share, from which it will access and copy the required executables and subsequently upload the acquired evidence to the same share post-collection. Permission requirements for said directory will be\u2026","rel":"","context":"In &quot;Kali Linux&quot;","block_context":{"text":"Kali Linux","link":"https:\/\/kalilinuxtutorials.com\/category\/kali\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":20449,"url":"https:\/\/kalilinuxtutorials.com\/androidqf\/","url_meta":{"origin":6072,"position":2},"title":"Androidqf : (Android Quick Forensics) Helps Quickly Gathering Forensic Evidence From Android Devices, In Order To Identify Potential Traces Of Compromise","author":"R K","date":"November 28, 2021","format":false,"excerpt":"Androidqf (Android Quick Forensics) is a portable tool to simplify the acquisition of relevant forensic data from Android devices. It is the successor of\u00a0Snoopdroid, re-written in Go and leveraging official adb binaries. androidqf is intended to provide a simple and portable cross-platform utility to quickly acquire data from Android devices.\u2026","rel":"","context":"In &quot;Kali Linux&quot;","block_context":{"text":"Kali Linux","link":"https:\/\/kalilinuxtutorials.com\/category\/kali\/"},"img":{"alt_text":"","src":"https:\/\/blogger.googleusercontent.com\/img\/a\/AVvXsEj4ehrhGisn0JdmNeC9_cF-VHSd7UwKYsSX7MtIKSHxTU39UPjxgI9Vm9UgCIJqfJuqaYAOt4n_k89gywMGeXB-505lCEcrtB2epW1QcIqvpK45VF5oyQ1AetmOoLy9i9HER-Mz0TCRLfxbnhnDP7yF-vQLIjB1HcFbMaaXLHx1PDKDjdy-aDxX5rJg=s694","width":350,"height":200,"srcset":"https:\/\/blogger.googleusercontent.com\/img\/a\/AVvXsEj4ehrhGisn0JdmNeC9_cF-VHSd7UwKYsSX7MtIKSHxTU39UPjxgI9Vm9UgCIJqfJuqaYAOt4n_k89gywMGeXB-505lCEcrtB2epW1QcIqvpK45VF5oyQ1AetmOoLy9i9HER-Mz0TCRLfxbnhnDP7yF-vQLIjB1HcFbMaaXLHx1PDKDjdy-aDxX5rJg=s694 1x, https:\/\/blogger.googleusercontent.com\/img\/a\/AVvXsEj4ehrhGisn0JdmNeC9_cF-VHSd7UwKYsSX7MtIKSHxTU39UPjxgI9Vm9UgCIJqfJuqaYAOt4n_k89gywMGeXB-505lCEcrtB2epW1QcIqvpK45VF5oyQ1AetmOoLy9i9HER-Mz0TCRLfxbnhnDP7yF-vQLIjB1HcFbMaaXLHx1PDKDjdy-aDxX5rJg=s694 1.5x"},"classes":[]},{"id":7229,"url":"https:\/\/kalilinuxtutorials.com\/dfirtriage-digital-forensic-acquisition\/","url_meta":{"origin":6072,"position":3},"title":"DFIRTriage : Digital Forensic Acquisition Tool For Windows Based Incident Response","author":"R K","date":"November 12, 2019","format":false,"excerpt":"DFIRTriage is a Digital forensic acquisition tool for Windows-based incident response. This tool intended to provide Incident Responders with rapid host data. Written in Python, the code has been compiled to eliminate the dependency of python on the target host.\u00a0 The tool will run a variety of commands automatically upon\u2026","rel":"","context":"In &quot;Kali Linux&quot;","block_context":{"text":"Kali Linux","link":"https:\/\/kalilinuxtutorials.com\/category\/kali\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":9453,"url":"https:\/\/kalilinuxtutorials.com\/mouse\/","url_meta":{"origin":6072,"position":4},"title":"Mouse : iOS &#038; macOS Post-Exploitation Framework","author":"R K","date":"March 2, 2020","format":false,"excerpt":"Mouse Framework is an iOS and macOS post-exploitation framework that gives you a command line session with extra functionality between you and a target machine using only a simple Mouse Payload. Mouse gives you the power and convenience of uploading and downloading files, tab completion, taking pictures, location tracking, shell\u2026","rel":"","context":"In &quot;Kali Linux&quot;","block_context":{"text":"Kali Linux","link":"https:\/\/kalilinuxtutorials.com\/category\/kali\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":27536,"url":"https:\/\/kalilinuxtutorials.com\/usbsas\/","url_meta":{"origin":6072,"position":5},"title":"Usbsas : Tool And Framework For Securely Reading Untrusted USB Mass Storage Devices","author":"R K","date":"October 29, 2022","format":false,"excerpt":"usbsas is a free and open source (GPLv3) tool and framework for securely reading untrusted USB mass storage devices. Description Following the concept of defense in depth and the principle of least privilege, usbsas's goal is to reduce the attack surface of the USB stack. To achieve this, most of\u2026","rel":"","context":"In &quot;Kali Linux&quot;","block_context":{"text":"Kali Linux","link":"https:\/\/kalilinuxtutorials.com\/category\/kali\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEhNvrdp2rHM_Z_3pm4XdoxY4MJwDAqDuq-cLpTGQEJqntrRYZdvqiBhEIgFbUIAfWlsKOcwiax9Zqo57rWs4qSZz89wlXgw3yyDx-i2z7UhGfqg5jnFJsmUPgtumBv__TyGUatBOYj-rsz3l62aE_1cnmSa77BnRdISjmTVP5Q7BkNDV4phZGYo2OEy\/s728\/usbsas-svg.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEhNvrdp2rHM_Z_3pm4XdoxY4MJwDAqDuq-cLpTGQEJqntrRYZdvqiBhEIgFbUIAfWlsKOcwiax9Zqo57rWs4qSZz89wlXgw3yyDx-i2z7UhGfqg5jnFJsmUPgtumBv__TyGUatBOYj-rsz3l62aE_1cnmSa77BnRdISjmTVP5Q7BkNDV4phZGYo2OEy\/s728\/usbsas-svg.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEhNvrdp2rHM_Z_3pm4XdoxY4MJwDAqDuq-cLpTGQEJqntrRYZdvqiBhEIgFbUIAfWlsKOcwiax9Zqo57rWs4qSZz89wlXgw3yyDx-i2z7UhGfqg5jnFJsmUPgtumBv__TyGUatBOYj-rsz3l62aE_1cnmSa77BnRdISjmTVP5Q7BkNDV4phZGYo2OEy\/s728\/usbsas-svg.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEhNvrdp2rHM_Z_3pm4XdoxY4MJwDAqDuq-cLpTGQEJqntrRYZdvqiBhEIgFbUIAfWlsKOcwiax9Zqo57rWs4qSZz89wlXgw3yyDx-i2z7UhGfqg5jnFJsmUPgtumBv__TyGUatBOYj-rsz3l62aE_1cnmSa77BnRdISjmTVP5Q7BkNDV4phZGYo2OEy\/s728\/usbsas-svg.png?resize=700%2C400&ssl=1 2x"},"classes":[]}],"_links":{"self":[{"href":"https:\/\/kalilinuxtutorials.com\/wp-json\/wp\/v2\/posts\/6072","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/kalilinuxtutorials.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/kalilinuxtutorials.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/kalilinuxtutorials.com\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/kalilinuxtutorials.com\/wp-json\/wp\/v2\/comments?post=6072"}],"version-history":[{"count":0,"href":"https:\/\/kalilinuxtutorials.com\/wp-json\/wp\/v2\/posts\/6072\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/kalilinuxtutorials.com\/wp-json\/wp\/v2\/media\/15724"}],"wp:attachment":[{"href":"https:\/\/kalilinuxtutorials.com\/wp-json\/wp\/v2\/media?parent=6072"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/kalilinuxtutorials.com\/wp-json\/wp\/v2\/categories?post=6072"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/kalilinuxtutorials.com\/wp-json\/wp\/v2\/tags?post=6072"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}