Skip to content
USBForensics

Posts tagged: #usbstor

← Back to all posts
USBSTOR Forensics: Serials and the 0064–0067 Timestamps
Reading Enum\USBSTOR and Enum\USB in the SYSTEM hive: vendor, product, serial, Windows-generated IDs, ContainerID and the device property timestamps.
usb-forensicsregistryusbstor