Skip to content
USBForensics

Glossary

Device property timestamps (0064–0067)

FILETIMEs under a device's Properties\{83da6326-…} key: 0064 install date, 0065 first install, 0066 last arrival, 0067 last removal.

Windows 8+ keeps device properties under Enum\…\<instance>\Properties. The {83da6326-97a6-4088-9453-a1923f573b29} group holds property IDs 100–103 of devpkey.h: 0064 InstallDate, 0065 FirstInstallDate, 0066 LastArrivalDate, 0067 LastRemovalDate, each a FILETIME.

They give the first install and the latest arrival and removal only, and disappear when the device is uninstalled. Compare them with setupapi.dev.log and the event logs. See USBSTOR forensics.