Skip to content
USBForensics

Posts tagged: #event-logs

← Back to all posts
Partition/Diagnostic 1006: USB Arrivals and Volume Serials
Event 1006 in Microsoft-Windows-Partition/Diagnostic logs each USB disk with model, serial and boot records. How to read it and extract the volume serial number.
usb-forensicsevent-logsvolume-serial-number
USB Device Forensics on Windows: The Complete Map
Every Windows artifact that records a USB stick — registry, setupapi.dev.log, event logs, LNK, Jump Lists, ShellBags — and how to tie them to one device.
usb-forensicsregistryevent-logsdfir