ZEKASTRA

WindowsCoreExternal devices

USB device history (USBSTOR, USB, MountedDevices, setupapi.dev.log)

USBSTOR, USB and MountedDevices keys plus setupapi.dev.log, which together identify attached storage devices, serials and volume mappings.

01Location

  • SYSTEM hive: ControlSet00n\Enum\USBSTOR\<Type>&Ven_<Vendor>&Prod_<Product>&Rev_<Revision>\<instance>
  • SYSTEM hive: ControlSet00n\Enum\USB
  • SYSTEM hive: MountedDevices
  • SOFTWARE hive: Microsoft\Windows Portable Devices
  • NTUSER.DAT: Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2
  • C:\Windows\INF\setupapi.dev.log

02Questions it answers

  • Which USB mass-storage devices (vendor, product, revision, serial) were connected?
  • When was a device instance first installed on the system?
  • Which drive letter or volume GUID was mapped to a device?
  • Which user profile saw the volume (MountPoints2)?

03Format and versions

FormatRegistry keys. USBSTOR instance keys hold FriendlyName, HardwareID, ContainerID and a Properties tree whose Data values are typed (0x0007 32-bit integer, 0x0010 FILETIME, 0x0012 UTF-16LE string). MountedDevices values contain a UTF-16LE device string, a GPT form ('DMIO:ID:' + partition GUID) or an MBR form (disk signature + partition offset). SetupAPI logs are ANSI plain text.
Applies toUSBSTOR and MountedDevices: Windows 2000 to 11. SetupAPI.dev.log: Windows Vista and later (setupapi.log in %SystemRoot% before). DEVPKEY_Device_FirstInstallDate: Windows 7 and later.

04Key fields

FieldWhat it tells you
USBSTOR device key<Device Type>&Ven_<Vendor>&Prod_<Product>&Rev_<Revision Number>; derived from the USBSTOR.SYS device identifier.
Instance key nameDevice serial number; if '&' is the second character the value is only unique on that system.
FriendlyName / MfgHuman-readable device description and manufacturer.
Enum\USBVendor and product IDs (VID/PID); match on the serial number from USBSTOR.
Device Parameters\Partmgr DiskIdGUID identifying the disk.
MountedDevices values\DosDevices\<letter>: and \??\Volume{GUID} names mapped to device strings, GPT or MBR identifiers.

05Timestamps

FieldEncodingNote
Properties values of type 0x0010FILETIME (UTC)Device property times stored under the instance key's Properties tree.
DEVPKEY_Device_FirstInstallDateFILETIME (DEVPROP_TYPE_FILETIME)Time the device instance was first installed; unlike DEVPKEY_Device_InstallDate it does not change with driver updates.
MountedDevices key last written timeFILETIME (UTC)Applies to the whole key, not to each value.

Decode raw values with the Timestamp decoder and convert local wall-clock times with the Local time to UTC.

06Examination workflow

  1. Enumerate USBSTOR device and instance keys in every control set; record vendor, product, revision, serial and FriendlyName.
  2. Find the same serial under Enum\USB to obtain VID and PID.
  3. Read the typed Properties values, including the first install date.
  4. Map the device to volumes and letters through MountedDevices, Partmgr DiskId and per-user MountPoints2.
  5. Search setupapi.dev.log for the device instance ID to confirm installation entries.

07Interpretation pitfalls

  • An instance ID with '&' as second character is generated by Windows and is not the device's own serial number.
  • USBSTOR covers mass-storage devices; portable devices are listed under Windows Portable Devices.
  • Stale MountedDevices entries can be removed (mountvol /r), so absence is not proof of non-use.

09Sources

  1. USB storage libyal / winreg-kb · checked 2026-10-14
  2. Mounted devices libyal / winreg-kb · checked 2026-10-14
  3. Identifiers Generated by USBSTOR.SYS Microsoft Learn · checked 2026-10-14
  4. SetupAPI Text Logs Microsoft Learn · checked 2026-10-14
  5. DEVPKEY_Device_FirstInstallDate Microsoft Learn · checked 2026-10-14
  6. RECmd batch file Kroll_Batch.reb (key descriptions) Eric Zimmerman / Kroll (GitHub) · checked 2026-10-14
  7. Windows artifact definitions (windows.yaml) ForensicArtifacts / artifacts · checked 2026-10-14