Skip to content
USBForensics

Glossary

Device instance ID

The path-like name Windows gives a device node, such as USBSTOR\Disk&Ven_X&Prod_Y&Rev_1.00\SERIAL&0, used across the registry, logs and setupapi.

A device instance ID is the path-like name Windows gives each device node: <enumerator>\<device ID>\<instance ID>. The enumerator is the bus or software component that found the device (USB, USBSTOR, SWD), the device ID describes the model, and the instance ID tells apart devices of the same model. For USB storage with a proper serial, the instance ID is built from that serial. Every node has a key named after its instance ID under SYSTEM\ControlSet00x\Enum.

Why it matters in investigations

The instance ID is the thread that runs through almost every USB artifact. The same string appears in registry key paths, in setupapi.dev.log section headers, in Kernel-PnP events, in Security 6416 and in the ParentId field of Partition/Diagnostic 1006. A #-separated form, the device interface path, appears in MountedDevices data, in EMDMgmt subkey names and under WPDBUSENUM. Extract the serial part once and you have the first correlation key between all of them.

Three details decide whether the join works:

  • USBSTOR instance IDs append & and a logical unit number to the serial. Strip the trailing &0 before comparing with Enum\USB.
  • If the second character of the instance ID is &, the device reported no usable serial and the ID was generated by Windows; it only means something on this computer.
  • Case varies between sources (SOFTWARE key names are often uppercase), so compare without regard to case.

Example

USB\VID_3F10&PID_4C21\CS1234567890
USBSTOR\Disk&Ven_Contoso&Prod_SecureFlash&Rev_1.00\CS1234567890&0
_??_USBSTOR#Disk&Ven_Contoso&Prod_SecureFlash&Rev_1.00#CS1234567890&0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}

The first line is the USB device (vendor 3F10, product 4C21), the second the disk, and the third the disk's device interface path as stored in MountedDevices. The GUID at the end is the disk interface class. All three carry the same serial, CS1234567890.

USB Forensics normalises every form of the instance ID and joins the sources on it. The complete USB artifact map shows which artifact carries which identifier.