USB & external devices
USB device history
USB forensics cheat sheet: USBSTOR and USB keys, serial numbers, first and last connection times, drive letters, volume serials, setupapi.dev.log and event IDs.
- Location
- SYSTEM\CurrentControlSet\Enum\USBSTOR
- Proves
- Which USB storage devices were connected, when first and last, and by which user
- Timestamps
- Properties 0064 to 0067 and MountPoints2 LastWrite as FILETIME, UTC; setupapi.dev.log in local time; event logs in UTC
- Retention
- Keys persist until uninstall or cleanup; feature updates can reset USBSTOR and setupapi.dev.log; event logs roll over
- Access
- Administrator; SYSTEM, SOFTWARE and NTUSER.DAT locked live: collect via raw NTFS (KAPE) or VSS; setupapi logs copy directly
- Evidence of
- USB & external devices
- Type
- Registry
- Windows
- XPVista / 78 / 8.11011
- KAPE target
- RegistryHivesSystemRegistryHivesUserUSBDevicesLogsEventLogs
- Velociraptor
- Windows.Triage.Targets:RegistryHivesSystemRegistryHivesUserUSBDevicesLogsEventLogs
Tools
Compare all toolsWhat it is
Windows keeps several independent records every time a USB device is plugged in: the Plug and Play manager registers the device in the SYSTEM hive, the mount manager assigns a drive letter, the user's profile records the mount point, the driver installation is logged in a text file, and on Windows 10/11 several event logs capture the connection. No single source is complete; the investigation consists in correlating them around the device's serial number and the volume's serial number.
Location
| Artifact | Location | Windows |
|---|---|---|
| USB storage devices | SYSTEM\ControlSet00x\Enum\USBSTOR\<Disk&Ven_&Prod_&Rev_>\<serial> | All |
| All USB devices (VID/PID) | SYSTEM\ControlSet00x\Enum\USB\VID_xxxx&PID_yyyy\<serial> | All |
| Connection times | ...\<serial>\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0064 / 0065 / 0066 / 0067 | 0064/0065: 7+; 0066/0067: 8+ |
| Drive letters and volume GUIDs | SYSTEM\MountedDevices | All |
| Friendly names (phones, MTP, drives) | SOFTWARE\Microsoft\Windows Portable Devices\Devices | Vista+ |
| Volume serial number (ReadyBoost) | SOFTWARE\Microsoft\Windows NT\CurrentVersion\EMDMgmt | Vista+ (not populated when the system disk is an SSD) |
| User who mounted it | NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{volume GUID} | All |
| First installation | C:\Windows\inf\setupapi.dev.log (C:\Windows\setupapi.log on XP) | All |
| Connection events | Microsoft-Windows-Partition/Diagnostic 1006; Microsoft-Windows-Kernel-PnP/Configuration 400/410; Microsoft-Windows-DriverFrameworks-UserMode/Operational (disabled by default) | 10 / 11 |
What it proves
- A USB storage device with a given vendor, product and serial number was connected to this host.
- When: first installation, last connection and last removal (Windows 8+), plus individual connections from event logs.
- Which drive letter it received and, through
MountPoints2, which user was logged on when it was mounted. - With the volume serial number, you can tie the device to LNK files, Jump Lists and ShellBags that reference files on it.
- A serial whose second character is
&was generated by Windows because the device has no unique serial; it is not stable across hosts.
Key fields
| Field | Meaning |
|---|---|
| USBSTOR subkey name | Device class, vendor, product and revision |
| Serial subkey name | Device serial (or Windows-generated ID) |
FriendlyName | Name shown to the user |
ContainerID | Links the USBSTOR entry to the matching Enum\USB and other entries |
0064 | First install date |
0065 | Install date (last driver install) |
0066 | Last arrival (connection) date |
0067 | Last removal date |
MountedDevices value data | Links \DosDevices\E: or a volume GUID to the device ID |
Timestamps
| Timestamp | Set when | Format | Pitfalls |
|---|---|---|---|
0064–0067 Properties | Device install, arrival, removal | FILETIME, UTC | Only the first and most recent events are kept |
setupapi.dev.log "Section start" lines | Driver installation | Text, local time | Convert with the host's time zone (UTC vs local time) |
MountPoints2\{GUID} LastWrite | Volume mounted in that user's session | FILETIME, UTC | Last mount for that user |
| Partition/Diagnostic 1006 | Every connection/volume mount | UTC | Includes disk capacity, serials and partition data (sometimes the VBR) |
Retention and clearing
- Registry entries persist until removed (Device Manager uninstall, cleanup tools such as USBOblivion).
- Windows feature updates can remove
USBSTORand relatedEnumkeys and recreatesetupapi.dev.log; migrated device data may survive underSYSTEM\Setup\Upgrade\Pnp\CurrentControlSet\Control\DeviceMigration, and older hives may exist inWindows.oldand shadow copies. - Event logs roll over; the Partition/Diagnostic channel is usually small.
Collection
- KAPE targets:
RegistryHivesSystem,RegistryHivesUser,USBDevicesLogs(setupapi logs) andEventLogs; the compound targetUSBDetectivebundles them. - Velociraptor (
Windows.Triage.Targets): the same names;Windows.Registry.MountPoints2andWindows.Detection.Thumbdrives.Listhelp live. - Built-in:
reg query HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR /s
reg query HKLM\SYSTEM\MountedDevices
findstr /i "USBSTOR" C:\Windows\inf\setupapi.dev.log
wevtutil qe Microsoft-Windows-Partition/Diagnostic /f:text /c:20
Parsing tools
- Registry Explorer / RECmd (Eric Zimmerman): USB-related bookmarks and batch files.
- RegRipper:
usbstor,usb,mountdev,mp2plugins. - USBDeview (NirSoft): live overview of every device ever connected.
- EvtxECmd: maps for Partition/Diagnostic 1006 and Kernel-PnP events.
Investigation tips
- Pivot on the device serial across
USBSTOR,USB,MountedDevicesandWindows Portable Devices, then on the volume serial number to LNK and Jump List entries. - Build a connection timeline from Partition/Diagnostic 1006: it records each connection, unlike the registry, which keeps first and last only.
- Compare
0066/0067with SRUM and file activity to show data was copied during the connection window. - Check whether a feature update happened after the incident before concluding that a device was never connected.
- Phones and cameras (MTP) appear under
Windows Portable Devicesand in ShellBags, not inUSBSTOR.
Related artifacts
- ShellBagsShellBags cheat sheet: BagMRU and Bags keys in UsrClass.dat and NTUSER.DAT, shell items, folder timestamps, deleted and USB folders, and parsing with SBECmd.
- LNK shortcut filesLNK cheat sheet: Recent folder shortcuts, first and last open times, embedded target timestamps, volume serial, network share and TrackerDataBlock MAC.
- Jump ListsJump Lists cheat sheet: AutomaticDestinations and CustomDestinations, AppIDs, DestList entries with last access, access count and pin status, and JLECmd.
- Windows event logs (EVTX)Windows event log cheat sheet: EVTX locations, must-know event IDs for logons, processes, services and log clearing, retention, audit policy and parsing tools.
- Registry hivesRegistry hives cheat sheet: SYSTEM, SOFTWARE, SAM, SECURITY, NTUSER.DAT, UsrClass.dat, transaction logs, RegBack, LastWrite times and collection.
- Mounted Disk Images (ISO, IMG, VHD, VHDX)Mounted disk images cheat sheet: ISO/IMG/VHD/VHDX mounts, VHDMP events, MountedDevices, LNK and Jump List traces, Mark-of-the-Web gaps and a detection workflow.
- Bluetooth paired devicesBluetooth devices cheat sheet: BTHPORT paired device keys, MAC addresses and names, LastSeen/LastConnected times, BTHENUM, event logs and fsquirt transfers.
Glossary terms
- Volume serial numberThe identifier written to a volume when it is formatted; recorded in LNK files and Prefetch, it ties file activity to a specific volume.
- ControlSet and CurrentControlSetThe numbered configuration sets in the SYSTEM hive; CurrentControlSet is a runtime link that does not exist in an offline hive file.
- Registry key LastWrite timeThe single FILETIME stored in every registry key that records when the key or one of its values was last changed, in UTC.
- UTC vs local time in Windows artifactsWhy some Windows artifacts record UTC and others local time, and how the TimeZoneInformation registry key helps normalize a forensic timeline.