USB Drive Buster

Bust anyone who connects a USB drive to cheat in practical examinations.

Why I created this?

As practical examinations in Computer Science involve writing code, students tend to bring in USB drives with source code stored in it and they would connect to the system and copy paste the code without the invigilators knowing about it. This way of cheating was something that I observed in my college, so I decided to put an end to it. My system brings a solution to this problem as if one connects a USB drive, the system sends a message via Telegram to the invigilator about the details of the drive and other log info like date and time etc in a readable way.

Working

The script runs as a service in the background and monitors for USB flash drives connected to the computer and logs the details to a file usbdrivebuster.log which contains info about when the device was connected/disconnected, vendor & product name, serial id and the drive size. It also a sends a message via telegram so that the invigilators can know about it.

Prerequisites

• PowerShell 6.1.0 (or higher)
• PoshGram module installed
• Telegram requirements
  • Telegram account
  • Group chat created with bot as a member
  • Group chat ID (refer this video)

Setup

Set bot token and chat ID

In the main.ps1 script file paste the bot token and chat ID

$telegramBotToken = "nnnnnnnnn:xxxxxxx-xxxxxxxxxxxxxxxxxxxxxxxxxxx"
$telegramGroupChatId = "-nnnnnnnnn"

Create a service (Windows)

1. Install nssm from the scoop package manager

2. Create a service

   nssm install <service name> "C:\path\to\pwsh.exe" "-ExecutionPolicy Bypass -File C:\path\to\main.ps1"

   NOTE: The absolute path to the pwsh.exe and main.ps1 should be specified.

3. Configure the service

   nssm edit <service name>

   Specify the username and password for the user account: Log on > This account, click Edit service to save changes.

   

Usage

By default the service won't start automatically at startup. This can be changed by editing Details > Startup type

Service Operations

You can manage the service via the Task Manager: Task Manager > Services, here you can right-click and select the operation you want. This can also be done from the command-line with the commands mentioned below for Command Prompt and PowerShell.

NOTE: The following operations should be run with administrator privileges.

1. Start the service

   # cmd
   net start USBDriveBusterService
   
   # powershell
   Start-Service -Name USBDriveBusterService

2. Stop the service

   # cmd
   net stop USBDriveBusterService
   
   # powershell
   Stop-Service -Name USBDriveBusterService

3. Restart the service

   # cmd
   net restart USBDriveBusterService
   
   # powershell
   Restart-Service -Name USBDriveBusterService

4. Remove the service

   nssm remove USBDriveBusterService