Devices & software

USBSTOR and USB registry records

Windows device registry records can identify enumerated USB/storage devices. They help investigate device context, but they do not independently describe every connection or every file transferred.

Listen to the full guide

Speed Download MP33 min · AI narration

Useful for

Support that the examined host retained an enumeration record for a device identity.

Important limit

Prove a particular file was copied or executed from the device.

Location & availability

SYSTEM hive: Enum\USBSTOR and Enum\USB, with relevant device properties

Device class, Windows version and available properties affect identifiers and timestamps.

Fields to examine

Device instance, vendor/product and recorded serial information.
Device properties and their specific timestamp meanings.
Control set and related storage/volume identity.

What it can establish

Support that the examined host retained an enumeration record for a device identity.

What it cannot prove

Prove a particular file was copied or executed from the device.
Assume a serial string always uniquely identifies one physical device.

Use it in a screenshare

Acquire the relevant SYSTEM hive and identify device records with a supported parser.
Compare instance identifiers with SetupAPI records and volume context; avoid using a remembered drive letter as permanent identity.
Check LNK target volume data or file records before connecting an executable to that device. Record ambiguous identifiers.

A USB device record exists, and a shortcut points to a similarly labelled volume. That is a correlation lead. Establish stronger volume identity and actual file activity before claiming a tool was transferred from that device.

Cross-check the finding

Sources

Choose another artefact →