Windows registry artifactMounted Devices
Last Write Timestamp is for entire key, not each individual value
- Devices
- 1 key
SYSTEM
Registry keys
1 key that RECmd reads for this artifact
SYSTEMMountedDevicesLast Write Timestamp is for entire key, not each individual value
References
7 links
- github.comMountedDevices plugin(opens in new tab)
- what-when-how.com/windows-forensic-analysis/registry-analysis-windows-forensic-analysis-part-6/(opens in new tab)
- hatsoffsecurity.com/2014/12/04/mounted-devices-key/(opens in new tab)
- forensicfocus.com/articles/forensic-analysis-of-the-windows-registry/(opens in new tab)
- andreafortuna.org/2017/10/18/windows-registry-in-forensic-analysis/(opens in new tab)
- binary-zone.com/2020/04/03/no-drive-letter-no-usb-think-again/(opens in new tab)
- windowsir.blogspot.com/2004/12/mounted-devices.html(opens in new tab)
Source: RECmd/BatchExamples/DFIRBatch.reb(opens in new tab) v2.22 by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)