USBDevicesLogs
USB devices log files
- 3 paths
setupapi.logsetupapi.*.log- Version 1.1
- Eric Zimmerman, esecrpm
Paths on disk
3 paths
Notes
v1.1
Use wildcard to account for dated versions files and other forms of setupapi log
Ex: setupapi.dev.20221214_093731.log, setupapi.setup.log, setupapi.upgrade.log
References
4 links
- andreafortuna.org/2018/02/09/usb-devices-in-windows-forensic-analysis/(opens in new tab)
- hecfblog.com/2013/08/daily-blog-66-understanding-artifacts.html(opens in new tab)
- swiftforensics.com/2012/08/tracking-usb-first-insertion-in-event.html(opens in new tab)
- 13cubed.com/downloads/dfir_cheat_sheet.pdf(opens in new tab)