SetupAPI device installation logs

Location & availability

C:\Windows\inf\setupapi.dev.log; related setup logs when relevant

Logs can rotate or retain only part of the period. Interpret time and section status using the actual log format.

Fields to examine

• Device instance identifier and installation section boundaries.
• Operation timestamps and completion/error status.
• Driver package and installation context.

What it can establish

• Support a recorded device/driver installation operation.

What it cannot prove

• List every time a previously installed device was reconnected.
• Prove that the device contained or transferred a specific utility.

Use it in a screenshare

1. Preserve the full relevant log, including rotated copies if available.
2. Locate the exact device instance and keep the enclosing section, not just a single matching line.
3. Compare status and time with USB registry and volume evidence. Distinguish attempted installation from successful completion.

Worked example

SetupAPI records a storage device installation weeks before a match. This supports that installation event. It does not by itself put the device at the match or establish any file transfer then.

Cross-check the finding

• USBSTOR and USB registry records →Support that the examined host retained an enumeration record for a device identity.
• LNK shortcuts →Support a stored shortcut-to-target relationship.

Sources

• Microsoft — SetupAPI text logs ↗