On 5/24/07, Greg KH <greg@xxxxxxxxx> wrote:
On Thu, May 24, 2007 at 01:23:24PM -0400, Greg Freemyer wrote: > All, > > What is the kernel API for retrieving the S/N for a thumbdrive? It's a userspace API, use the volume_id program in the udev package (it's now also part of util-linux too.)
Thanks, I'll check it out.
> I've tried the userspace tools hdparm and sdparm with no luck. > Apparently the kernel APIs they use don't support a thumbdrive. ie. > Basically neither one is giving me much of anything for a thumbdrive. > > I've found sysfs has the Manufacturer & Model, but I have not found a > way to get the serial number. > > FYI: It is in the dmesg output immediately after plugging in a new > thumbdrive, so I know it is retrieved. Which serial number? The volume one, or the usb one? They are and can be different.
I guess both. We do computer forensics and need to have a way to verify the S/N reported by Windows in the registry is the same as physical thumbdrive. ie. We are occasionally given a Windows computer and a thumbdrive and told the thumbdrive was used to copy files off of the computer. Our job is to verify the statement. So Windows records the S/N in the registry, and we need to verify that the physical thumbdrive we were provided has the same S/N. Greg -- Greg Freemyer The Norcross Group Forensics for the 21st Century -- To unsubscribe from this list: send an email with "unsubscribe kernelnewbies" to ecartis@xxxxxxxxxxxx Please read the FAQ at http://kernelnewbies.org/FAQ
