USB Forensics — Blog https://www.usbforensics.com/en/blog Latest from Blog en Tue, 29 Sep 2026 12:44:22 GMT USB Exfiltration Investigation: A Worked Example https://www.usbforensics.com/en/blog/usb-exfiltration-investigation-walkthrough https://www.usbforensics.com/en/blog/usb-exfiltration-investigation-walkthrough A fictional intrusion walked through with USB Forensics: find the stick, confirm when it was connected, attribute the account and list the files copied. Florian Amette Sat, 26 Sep 2026 00:00:00 GMT Which Files Were Opened From a USB Stick? LNK, Jump Lists https://www.usbforensics.com/en/blog/link-files-to-usb-lnk-jumplists-shellbags https://www.usbforensics.com/en/blog/link-files-to-usb-lnk-jumplists-shellbags Tie shortcuts, Jump Lists, ShellBags and 4663 events to a physical USB device with volume serial numbers, drive letters and time, and name the user. Florian Amette Fri, 25 Sep 2026 00:00:00 GMT setupapi.dev.log: When a USB Device Was First Connected https://www.usbforensics.com/en/blog/setupapi-dev-log-usb-first-install https://www.usbforensics.com/en/blog/setupapi-dev-log-usb-first-install How to read setupapi.dev.log device install sections, convert their local times to UTC, and compare them with the registry's first install date. Florian Amette Thu, 24 Sep 2026 00:00:00 GMT Partition/Diagnostic 1006: USB Arrivals and Volume Serials https://www.usbforensics.com/en/blog/partition-diagnostic-1006-volume-serial https://www.usbforensics.com/en/blog/partition-diagnostic-1006-volume-serial Event 1006 in Microsoft-Windows-Partition/Diagnostic logs each USB disk with model, serial and boot records. How to read it and extract the volume serial number. Florian Amette Wed, 23 Sep 2026 00:00:00 GMT USBSTOR Forensics: Serials and the 0064–0067 Timestamps https://www.usbforensics.com/en/blog/usbstor-registry-key-forensics https://www.usbforensics.com/en/blog/usbstor-registry-key-forensics Reading Enum\USBSTOR and Enum\USB in the SYSTEM hive: vendor, product, serial, Windows-generated IDs, ContainerID and the device property timestamps. Florian Amette Tue, 22 Sep 2026 00:00:00 GMT Collect USB Artifacts with KAPE, Velociraptor or PowerShell https://www.usbforensics.com/en/blog/collect-usb-artifacts-kape-velociraptor https://www.usbforensics.com/en/blog/collect-usb-artifacts-kape-velociraptor What to collect for a Windows USB investigation — hives, setupapi.dev.log, event logs, user files — and the exact KAPE, Velociraptor and PowerShell steps. Florian Amette Mon, 21 Sep 2026 00:00:00 GMT USB Device Forensics on Windows: The Complete Map https://www.usbforensics.com/en/blog/usb-device-forensics-windows-guide https://www.usbforensics.com/en/blog/usb-device-forensics-windows-guide Every Windows artifact that records a USB stick — registry, setupapi.dev.log, event logs, LNK, Jump Lists, ShellBags — and how to tie them to one device. Florian Amette Sun, 20 Sep 2026 00:00:00 GMT