This is all done within the registry and not a log file unless some third party
synchronization software was used. There are unique descriptors created for
each device that lists information like what kind of device it is, number of
endpoints, etc.
You can read more about descriptors here:
http://www.beyondlogic.org/usbnutshell/usb5.htm
To get more information on the device itself, check out these keys:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume
HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR
To get more information on files check out the Most Recently Used (MRU) keys:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedMRU
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU
Also:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs
I would check these areas and see if any files match up to the location/device
of the USB flash drive in question. Hopefully the ?clear list? feature isn?t
selected for the recent opened documents. If so, it could clear the locations
above.
Another area I would check is the information within the virtual memory, as
well as the memory management key within the registry since it holds the
virtual memory configuration:
HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management
Helpful tools:
UVCView
http://www.microsoft.com/whdc/device/stream/vidcap/UVCview.mspx
USB Vendor ID List:
http://www.linux-usb.org/usb.ids
USB Specification ? download the latest version. Check out section 9.5, 9.6,
and 9.7 http://www.usb.org/developers/docs
As for the post about the DLT Service?. I believe that just monitors NTFS
volumes and since most flash drives like USB drives are FAT32, I am not sure if
the DLT client service will be much help. Still, maybe worth a look though.
Good luck!
