Glossary
USBSTOR
The SYSTEM hive key Enum\USBSTOR, where Windows keeps one entry per USB mass-storage device with vendor, product, revision and serial.
USBSTOR is the SYSTEM hive key ControlSet00x\Enum\USBSTOR, where Windows keeps one entry for every USB mass-storage device it has installed. Under it, one class key per model encodes the device type, vendor, product and revision reported by the device, such as Disk&Ven_Contoso&Prod_SecureFlash&Rev_1.00 (underscores stand for spaces). Under each class key, one instance key per device is named after its serial, an & and a logical unit number: CS1234567890&0.
Why it matters in investigations
USBSTOR is the inventory: it answers which storage devices were ever installed on this computer. Each instance key holds a FriendlyName (what Device Manager shows), a ContainerID that links it to the matching Enum\USB node, and a Properties subkey with the device property timestamps for install, first install, last arrival and last removal.
The serial in the instance name is the first correlation key with setupapi.dev.log, the event logs, MountedDevices and EMDMgmt. Before relying on it, check the second character: if it is &, the serial is a Windows-generated serial and only means something on this computer. Multi-slot card readers can show several instances with &0, &1 and so on, one per logical unit.
What USBSTOR does not tell you: who used the device, or what was done on it. For that you need per-user artifacts. Read the control set named by Select\Current; other control sets may hold older copies. Uninstalling a device removes its key entirely.
Example
SYSTEM\ControlSet001\Enum\USBSTOR\Disk&Ven_Contoso&Prod_SecureFlash&Rev_1.00\CS1234567890&0
FriendlyName = Contoso SecureFlash USB Device
ContainerID = {5c1e2a7d-8b34-4f0e-9d61-2a7c4e9b0f13}
Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0064 … 0067
Vendor Contoso, product SecureFlash, revision 1.00, serial CS1234567890, LUN 0.
Related terms
- Device instance ID: the naming scheme of the instance key.
- ContainerID: the link to
Enum\USBand WPDBUSENUM. - Device property timestamps: the dates under
Properties. - MountedDevices: the drive letter and volume GUID for the same serial.
USB Forensics reads USBSTOR from the SYSTEM hive and builds one card per device. The details are in USBSTOR forensics.