Windows registry artifactUSBSTOR
Displays list of USB devices that have been plugged into this system. If & is second character within serial number, serial number is only unique on the system
- Devices
- 1 key
SYSTEM
Registry keys
1 key that RECmd reads for this artifact
SYSTEMControlSet*\Enum\USBSTORDisplays list of USB devices that have been plugged into this system. If & is second character within serial number, serial number is only unique on the system
References
5 links
- github.comUSBSTOR plugin(opens in new tab)
- jaiminton.com/cheatsheet/DFIR/(opens in new tab)
- 13cubed.com/downloads/dfir_cheat_sheet.pdf(opens in new tab)
- swiftforensics.com/2013/11/windows-8-new-registry-artifacts-part-1.html(opens in new tab)
- tristiansforensicsecurity.com/2018/11/28/basic-usb-forensics-in-windows/(opens in new tab)
Source: RECmd/BatchExamples/DFIRBatch.reb(opens in new tab) v2.22 by Andrew Rathbun and contributors(opens in new tab), MIT License(opens in new tab)