Carbon Black Cloud: "uDisk" USB devices experience serial number corruption (changing, unusual characters, entirely missing) that prohibit USB approval process via serial numbers.

[#1]

Environment

• Carbon Black Cloud Sensors: All versions
• Carbon Black Cloud Console: All versions
• Sensor Operating Systems: All versions
• "USB" devices: uDisk

Symptoms

1. Inventory -> USB DEVICES lists devices with the PRODUCT value "uDisk" 
2. The SERIAL NUMBER is either missing, or has unusual characters like Љ <- Љ ‎(upper case, lower case љ ... the fourteenth letter of the Serbo-Croatian Cyrillic alphabet)
3. The SERIAL NUMBER may change after ejecting and reinserting.

Resolution

The "uDisk" designation is a sign of a problem between the device and the Operating System (e.g. occurs without the Carbon Black Cloud sensor in the picture)

From this article

"If your USB flash drive mounts as a UDISK on your computer, it means it’s a bad USB drive with firmware that doesn’t match the memory type and controller combination. The drive is saying it’s using flash memory, when in reality it’s just a small hard drive. Without the correct firmware in the controller, the USB stick is unstable and the operating system tips users about the problem by calling it a UDISK."

Related Content

https://askubuntu.com/questions/737552/usb-stick-acting-very-odd-cant-format-it-either

https://forums.debian.net/viewtopic.php?t=141758