09 · USB & External Devices
USB Device Forensics: Tracing Drives, Users and Files
Identify every USB drive connected to a Windows host, date its connections, tie it to a user and prove which files were opened from it, step by step.
Area 09
USB & External Devices
Data theft investigations often hinge on a single USB stick. This area covers device identification in the registry, connection timestamps across Windows versions, user attribution through MountPoints2, the Partition/Diagnostic log, and linking a device's volume serial to LNK files and ShellBags.
Key sources
- USBSTOR
- setupapi.dev.log
- Partition/Diagnostic
Guides in this area
Artifact cheat sheets
Location by Windows version, what each artifact proves, its timestamps and the tools to parse it.
- USB device historyUSB forensics cheat sheet: USBSTOR and USB keys, serial numbers, first and last connection times, drive letters, volume serials, setupapi.dev.log and event IDs.
- LNK shortcut filesLNK cheat sheet: Recent folder shortcuts, first and last open times, embedded target timestamps, volume serial, network share and TrackerDataBlock MAC.
- ShellBagsShellBags cheat sheet: BagMRU and Bags keys in UsrClass.dat and NTUSER.DAT, shell items, folder timestamps, deleted and USB folders, and parsing with SBECmd.
- Jump ListsJump Lists cheat sheet: AutomaticDestinations and CustomDestinations, AppIDs, DestList entries with last access, access count and pin status, and JLECmd.
- Bluetooth paired devicesBluetooth devices cheat sheet: BTHPORT paired device keys, MAC addresses and names, LastSeen/LastConnected times, BTHENUM, event logs and fsquirt transfers.
- Mounted Disk Images (ISO, IMG, VHD, VHDX)Mounted disk images cheat sheet: ISO/IMG/VHD/VHDX mounts, VHDMP events, MountedDevices, LNK and Jump List traces, Mark-of-the-Web gaps and a detection workflow.
- Print spooler files (.SPL and .SHD)Print spool cheat sheet: .SPL and .SHD files in spool\PRINTERS, EMF content recovery, PrintService event 307, printer drivers and PrintNightmare traces.