Device property timestamps (0064–0067)

Device property timestamps are four FILETIME values that Windows 8 and later store under each device's instance key, in SYSTEM\ControlSet00x\Enum\<enumerator>\<device>\<instance>\Properties\{83da6326-97a6-4088-9453-a1923f573b29}. They are property IDs 100 to 103 of that GUID in Windows' devpkey.h, stored as subkeys named in hexadecimal: 0064 InstallDate, 0065 FirstInstallDate, 0066 LastArrivalDate and 0067 LastRemovalDate. Each is the default value of its subkey, typed 0xFFFF0010 (a FILETIME device property), in UTC.

Why it matters in investigations

These are the registry's answer to when. 0065 dates the first installation of the device on this computer, 0066 the most recent connection and 0067 the most recent removal. They exist on the USB node and on the USBSTOR node alike, so you can check one against the other.

Their limits matter as much as their values:

They keep only the latest arrival and removal. Earlier connections must come from the event logs.
Uninstalling the device deletes the instance key and its properties; the next connection starts a new history. A setupapi.dev.log section older than 0065 usually means exactly that.
Some published guides swap 0064 and 0065. The devpkey.h definitions are the reference.
Windows 7 used a deeper layout, with a Data value under 00000065\00000000.

Example

Enum\USBSTOR\Disk&Ven_Contoso&Prod_SecureFlash&Rev_1.00\CS1234567890&0\
  Properties\{83da6326-97a6-4088-9453-a1923f573b29}\
    0064  (Default)  2026-09-14 10:30:14 UTC   InstallDate
    0065  (Default)  2026-09-14 10:30:14 UTC   FirstInstallDate
    0066  (Default)  2026-09-14 10:30:15 UTC   LastArrivalDate
    0067  (Default)  2026-09-14 10:50:40 UTC   LastRemovalDate

Here install and first install are equal, so the device was installed only once. The newest Partition/Diagnostic 1006 arrival should match 0066; if it does not, note the gap rather than picking one source.

USBSTOR: the instance keys that carry these properties.
Device instance ID: the key path under which they are stored.
Partition/Diagnostic event 1006: every arrival, not just the last.

USB Forensics reads all four values and puts them on one timeline next to setupapi.dev.log and the event logs. The details are in USBSTOR forensics and setupapi.dev.log for USB.

Why it matters in investigations

Example

Related terms