Skip to content
USBForensics

Glossary

Windows-generated serial

A USB instance ID made up by Windows when the device reports no usable serial, recognisable by an & in second position, as in 7&1f2e3d4c&0.

A Windows-generated serial is an instance ID that Windows makes up when a USB device does not report a usable serial number. USB devices are supposed to provide a unique serial in their descriptor, and Windows normally uses it as the instance ID under SYSTEM\ControlSet00x\Enum\USB and Enum\USBSTOR. Many cheap card readers and some sticks report none, or one that Windows does not treat as unique. Windows then builds an ID from where the device sits in the USB tree, such as 7&1f2e3d4c&0. The tell is an & in the second position.

Why it matters in investigations

A generated ID looks like a serial but does not behave like one:

  • It is unique only on this computer. It is not printed on the device and will not match the same device on another machine.
  • It depends on the port and hub path, so the same device plugged into another port can appear as a second entry.
  • The USB node and the USBSTOR node get different generated IDs, so the usual serial join fails. The ContainerID is then the only link between them.

Do not report such a value as "the device serial". Identify the device instead by vendor and product, capacity, volume serial number, volume label and the timing of its connections, and say that the instance ID was generated by Windows.

Example

Enum\USB\VID_1E4F&PID_0726\5&2a9c1d77&0&3
    ContainerID = {c3d9e1f0-2b4a-4c6d-8e7f-1a2b3c4d5e6f}
Enum\USBSTOR\Disk&Ven_Litware&Prod_Card_Reader_SD&Rev_1.00\7&1f2e3d4c&0
    ContainerID = {c3d9e1f0-2b4a-4c6d-8e7f-1a2b3c4d5e6f}

Both instance IDs have & as their second character, and they differ from each other. Only the shared ContainerID shows that they are one card reader.

USB Forensics flags generated serials on each device card. More in USBSTOR forensics, and a worked case in the exfiltration walkthrough.