Removable media changes the nature of an investigation. A hard drive stays put. A server leaves logs. A USB flash drive can appear for five minutes, move critical data, and disappear forever.
Lecture 3.5 focuses on USB forensics, the discipline of proving that an external device was connected, identifying what it was, when it arrived, how long it stayed, and which user interacted with it. Even if the device is never recovered, Windows leaves behind enough evidence to rebuild the event with confidence.
In Ocsaly Academy terms, this is a Strategic Move. We stop chasing files and start proving physical interaction with hardware.
1. How Windows Handles USB Devices at a Low Level
When a USB device is plugged into a Windows system, several things happen automatically. This is not optional behavior and it cannot be bypassed by normal users.
- The USB controller detects a new device.
- Windows reads the device identifiers.
- The operating system loads a driver.
- Registry entries are created.
- Log files are written.
- A volume is mounted if the device contains storage.
This process is handled partly in user mode and partly in kernel mode. The important takeaway is this:
Windows must record the device in order to use it.
Those records are our evidence.
2. USBSTOR Registry Key: The Device Inventory
The first and most important artifact is the USBSTOR registry key.
Location
HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR
This key acts as a device inventory. Every USB storage device that has ever been connected to the system leaves an entry here.
[DIAGRAM: USBSTOR registry hierarchy showing vendor, product, and serial number]
What USBSTOR Tells Us
Each device entry contains:
- Vendor name
- Product name
- Device class
- Device serial number or unique identifier
Example interpretation, explained simply:
- Vendor: SanDisk
- Product: Cruzer Blade
- Serial: A unique number tied to that physical device
If the same USB is plugged in again weeks later, Windows recognizes it as the same device.
Forensic Alert:
If a USB device appears in USBSTOR, it was physically connected. There are no false positives.
3. Device Installation Time: When the USB First Appeared
USBSTOR alone does not tell us when the device was first connected. For that, we pivot to the device instance key.
Location
HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR\<DeviceID>\<InstanceID>
Inside this key is a timestamp called LastWrite Time.
What This Timestamp Means
- This timestamp usually represents the first time the device was installed on the system.
- It is written when Windows sets up the device driver.
- It does not change on every insertion.
This gives us a starting point in the timeline.
Investigative Tip:
First connection time is critical when proving that a device appeared shortly before data went missing.
4. MountedDevices: Drive Letters and Volume Identity
Knowing a device existed is not enough. We must prove how Windows mounted it.
Location
HKLM\SYSTEM\MountedDevices
This key maps:
- Volume serial numbers
- To drive letters like E: or F:
[DIAGRAM: MountedDevices mapping showing volume serial number linked to drive letter]
Why This Matters
Other artifacts, such as LNK files and Jump Lists, record drive letters and volume serial numbers.
If you see:
- LNK file referencing E:
- MountedDevices showing that serial number was assigned E:
- USBSTOR showing the same serial number
You have cross artifact confirmation.
This is how we prove that a document opened from E: came from a specific USB device.