Plug a USB device into a Windows computer, whether that is a thumb drive, an external SSD, or a phone in storage mode, and the operating system quietly writes it down. Long after the device is unplugged and the user considers the matter closed, traces of that connection sit on the system for months or years.
For most people none of this matters. For investigators it matters a great deal. USB activity is one of the most common things we get asked about at Data Rescue Labs. Did this device ever get connected to this computer? When? How many times? Was data moved off the machine?
What follows is a high-level walkthrough of where Windows keeps that information and how examiners get at it.
Where the USB history lives
Windows stores most of its USB device history in the system registry, a hierarchical database that holds the operating system's configuration. Two registry hives matter here.
The SYSTEM hive holds the technical record of every USB device the OS has enumerated. Storage devices such as thumb drives, external HDDs and card readers live in a dedicated section called USBSTOR. Everything else, meaning mice, webcams, dongles and phones in PTP mode, lands under USB and related enumerators. Each device's section contains its vendor ID, product ID, and device serial number, which is a unique identifier hardcoded into the device by its manufacturer.
The SOFTWARE hive holds the friendly, user-visible side of the same record. The name a user would have seen when the device appeared in File Explorer, something like "SanDisk (E:)", along with the drive letter Windows assigned it.
Those two hives cross-reference on the device serial number, so an investigator can move between the technical record and the user-facing record without losing track of which device is which.
The timestamps
Each device's registry entry carries a small block of timestamps that tell the forensic story:
- First installed — the very first time the device was ever plugged into this computer.
- Last connected — the most recent time it was plugged in.
- Last removed — the most recent time it was unplugged.
Those three values, pulled from one device's registry entry, can establish a timeline that reaches months or years either side of an incident. It is not uncommon to find that a device everyone believed had been used once was actually connected on several separate occasions spread across a long stretch of time.
Supporting artifacts
The registry is the headline source but not the only one. A thorough USB review usually pulls from several places:
setupapi.dev.log, a plain-text Windows log recording the first-ever installation of every device with timestamps. This is the most authoritative first-connection source on the system.- Windows event logs. Depending on the Windows version, channels like
Microsoft-Windows-Partition/DiagnosticandMicrosoft-Windows-Kernel-PnP/Configurationcapture per-event records of device arrival and removal, often with the device's full metadata. - Per-user registry data (
NTUSER.DAT), which tracks which user account mounted each device. Useful on multi-user machines. - LNK files and Jump Lists, shortcut artifacts that can show a user opened files living on a particular USB drive, even after the drive is long gone.
Together these let us answer not only when a device was connected, but by whom, what files lived on it, and whether content moved between the device and the host.
The tools
Most of the registry work runs through Registry Explorer and its command-line companion RECmd, both from Eric Zimmerman. They read Windows registry hive files at a binary level, replay transaction logs to reconstruct the most current state of the registry, and decode the raw timestamps into something readable. They are a de facto standard among practitioners.
Why this matters
USB questions come up across IP theft and data exfiltration investigations, insider-threat reviews, regulatory and compliance audits, civil litigation and incident response.
What makes these artifacts useful is that they are quiet, automatic and hard to spoof. The operating system records them itself, without the user's knowledge, every time a device touches the machine.
If your organization needs to know whether a specific USB device was used on a particular computer, when, or by whom, that question is almost always answerable from a properly preserved disk image.
Need to establish whether a USB device was connected to a Windows machine — and when, and by whom? Our Computer Forensics and Corporate Services teams handle this work. Open a case for a privileged consult.