Skip to content
USBForensics

Posts tagged: #registry

← Back to all posts
USBSTOR Forensics: Serials and the 0064–0067 Timestamps
Reading Enum\USBSTOR and Enum\USB in the SYSTEM hive: vendor, product, serial, Windows-generated IDs, ContainerID and the device property timestamps.
usb-forensicsregistryusbstor
USB Device Forensics on Windows: The Complete Map
Every Windows artifact that records a USB stick — registry, setupapi.dev.log, event logs, LNK, Jump Lists, ShellBags — and how to tie them to one device.
usb-forensicsregistryevent-logsdfir