USB devices & removable paths
Relate installation, connection, and file-path observations without turning a device record into a transfer log.
Question & scope
Removable storage can explain a historical drive letter, a shortcut target, or a utility that is no longer present on an internal volume. Ask which device and which connection window matter to the disputed session. Windows installation logs and registry or event context can provide identifiers, but installation, connection, mounting, and file transfer are different events.
SetupAPI.dev.log records device installation information and commonly resides in the Windows INF directory. Preserve a collected copy before examining it. Installation records are useful context, but they do not enumerate every subsequent insertion or every file copied from the device.
What to collect
| Source | Retain and examine |
|---|---|
| Installation log | A collected SetupAPI.dev.log with original metadata. |
| Device identity | Available instance identifiers, serial information, and source fields. |
| Volume context | Historical volume information, mount context, and relevant drive letters. |
| File evidence | Shortcuts, Prefetch volume references, and filesystem or game records. |
Examination workflow
- Record the Windows build and the device-related question before choosing sources.
- Collect installation, registry, and relevant event context; document which sources were available.
- Match complete identifiers cautiously. A generic device class or display name is not a unique identity.
- Resolve historical drive letters using volume context before assigning a path to a current device.
- Correlate device context with specific file and execution records, keeping unsupported transfer claims separate.
Interpretation & false positives
A device installed once may produce no new installation record during a later insertion. Event availability varies across builds, providers, and logging configuration. Do not assign one universal event ID or a fixed retention period to every system.
Serial and instance fields may represent different layers of identity; some devices provide weak or non-unique identifiers. A connected drive is not proof that a particular file was copied or run. An absent drive at collection time does not eliminate surviving historical paths.
Worked scenario
A shortcut and a Prefetch volume reference point to a removable volume, while installation data identifies a compatible USB device. This is a correlation lead, not a complete transfer history. Record how the volume and device were mapped, identify uncertainty, and search for the specific file’s independent records.
Report checklist
- Installation and later connection are distinguished.
- Device and volume identifiers retain their source fields.
- Drive letters are interpreted historically.
- Transfers or execution are supported by file-specific evidence.
Sources & further reading
The workflow and scenario are authored investigation guidance. Confirm source-system and parser support for the build you examine.