Skip to content
USBForensics

Glossary

Device instance ID

The path-like name Windows gives a device node, such as USBSTOR\Disk&Ven_X&Prod_Y&Rev_1.00\SERIAL&0, used across the registry, logs and setupapi.

A device instance ID is <enumerator>\<device ID>\<instance>: USB\VID_3F10&PID_4C21\CS1234567890 for the USB device, USBSTOR\Disk&Ven_Contoso&Prod_SecureFlash&Rev_1.00\CS1234567890&0 for the disk.

The same string (or a #-separated form) shows up in the registry, setupapi.dev.log, Kernel-PnP events, Security 6416 and MountedDevices, which makes the serial part the first correlation key. See USBSTOR.