Michael and Ricci,
USB storage devices are listed under
HKLM\System\CurrentControlSet\Enum\USBStor
--- Michael.Wade@ferguson.com wrote:
Windows records each device plugged into the USB
interface in the
registry key
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB.
There
you will see a series of keys which names like
Vid_049f&Pid_0056. The
key underneath will have a DESC entry which will
describe the device's
friendly name.
As far as listing when and how many times they have
been inserted, I
don't know anywhere that is listed.
-----Original Message-----
From: ricci@cs.ust.hk [mailto:ricci@cs.ust.hk]
Sent: Monday, May 08, 2006 6:43 PM
To: focus-ms@securityfocus.com
Subject: USB device installation problem
Hello All,
Currently, USB usage becomes one of the most
important part in Windows
systems. If I would like to check how many USB
external storage has been
inserted to the computer before and when is they
have been inserted and
removed, is there any way I can check that from
registry? or is there
any
other location I can find that?
Please advise.
Thx.
Ricci
------------------------------------------------------------------------
---
------------------------------------------------------------------------
---
---------------------------------------------------------------------------
---------------------------------------------------------------------------
------------------------------------------
Harlan Carvey, CISSP
"Windows Forensics and Incident Recovery"
http://www.windows-ir.com
http://windowsir.blogspot.com
------------------------------------------
---------------------------------------------------------------------------
---------------------------------------------------------------------------
