USB Device History on Windows 11: What the Registry Proves

What Windows Remembers

Plug a USB stick into a Windows machine once, and the machine keeps a record of it — the vendor, the product, and usually the device's own serial number — indefinitely. Removing the device does not remove the record. Neither does a normal cleanup.

This is why USB history answers questions nothing else can: was data copied off this machine, was this specific stick ever in this specific PC, when did the device first appear.

The Four Sources

Read them together. Each holds a piece, and the serial number is what joins them.

USBSTOR — the device list

HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR

One key per device model, then one subkey per individual device. The subkey name is the pattern:

Disk&Ven_SanDisk&Prod_Cruzer_Blade&Rev_1.00\4C530001120523118440&0

That long value is the device serial number, assigned by the manufacturer and burned into the device. It is what makes this identification rather than description.

One caveat that matters: if the second character of the serial is &, the device does not report a serial and Windows generated that value itself. Such a value is unique to this machine and cannot be used to prove the same physical device appeared on another PC.

Under each device key, the Properties subkey holds timestamps. The GUID-named values there include first install, last arrival, and last removal times. Registry Explorer decodes these; Registry Editor shows them as raw binary.

setupapi.dev.log — first connection, in plain text

C:\Windows\INF\setupapi.dev.log

A plain-text device installation log. When a USB device is attached for the first time, Windows installs its driver and writes a block here, timestamped.

>>>  [Device Install (Hardware initiated) - SWD\WPDBUSENUM\...]
>>>  Section start 2026/08/06 14:22:19.113

Search the file for the serial number you pulled from USBSTOR. The Section start line immediately above it is your first-connect time for that device on this machine.

This log is not rotated aggressively, so it frequently reaches back much further than the event log does — often to the original Windows installation.

MountedDevices — which drive letter it got

HKLM\SYSTEM\MountedDevices

Maps drive letters and volume GUIDs to the underlying device. Look for \DosDevices\E: and similar. The binary value contains the device identifier, and the serial number is readable inside it as text.

This connects the physical device to a drive letter, which is what you need to interpret any other artifact that recorded a path like E:\.

The per-user mount record

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2

Per-user, so this is the artifact that provides attribution. USBSTOR is machine-wide and cannot tell you which account was logged in. MountPoints2 sits in that user's NTUSER.DAT, so its presence establishes that this specific profile had the volume mounted.

Step 1: Enumerate the devices

reg query "HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR" /s | Select-String "Disk&Ven"

Write down vendor, product, and serial for each. This is your device list.

Step 2: Date each device's first connection

For each serial, search the installation log:

Select-String -Path C:\Windows\INF\setupapi.dev.log -Pattern "4C530001120523118440" -Context 4,0

The Section start timestamp in the preceding lines is the first connect.

Step 3: Resolve drive letters

reg query HKLM\SYSTEM\MountedDevices

Match the serial inside the binary values to a \DosDevices\<letter>: entry. Now you know that when another artifact references F:\, it meant this device.

Step 4: Attribute to a user

For each user profile, load C:\Users\<user>\NTUSER.DAT in Registry Explorer and check Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2 for the volume GUID from the previous step.

Step 5: Establish what was actually accessed

Device history proves a device was attached. It does not prove a file was copied. For that, move to the artifacts that record file access:

• LNK files and Jump Lists — C:\Users\<user>\AppData\Roaming\Microsoft\Windows\Recent\ — record the target path and the volume serial number of the drive the file lived on. A .lnk pointing at F:\report.docx with a matching volume serial is direct evidence a file on that device was opened.
• Shellbags — prove a folder on the device was browsed in Explorer.
• Prefetch — if a program ran from the device, its .pf file records the source directory.

Limits

No file copy record. Windows does not log file copies natively. USB history plus LNK files plus Shellbags builds a strong circumstantial case; none of it is a copy log.

Generated serials are machine-local. The & in the second character tells you the serial was assigned by Windows, not the device. Cross-machine correlation is impossible for those.

USBSTOR covers mass storage only. Phones in MTP mode, cameras, and USB devices that are not disks appear under HKLM\SYSTEM\CurrentControlSet\Enum\USB and WPDBUSENUM instead. A phone plugged in for charging that was used for file transfer will not be in USBSTOR.

Related

• Windows 11 forensic artifacts overview
• 30-minute triage of a suspected-compromised PC
• Consumer guide: wiping a PC before selling or donating it — this is what a buyer could otherwise recover

FAQ

Does Windows record every USB device ever plugged in?

Every USB mass-storage device, effectively permanently, in USBSTOR. Non-storage devices are recorded elsewhere (Enum\USB, WPDBUSENUM) with less detail. There is no automatic expiry — records from years ago routinely survive on machines that have not been reinstalled.

Can I tell what files were copied to a USB drive?

Not directly. Windows has no native file-copy log. You can build a strong circumstantial case from LNK files (which record the target path and the source volume's serial number), Shellbags (folders browsed), and Jump Lists (files opened per application) — but none of those is proof of a copy operation.

What does the "&" in a USB serial number mean?

If the second character of the serial is &, the device did not report a serial number and Windows generated the value itself. That generated value is unique to this machine only, so it cannot be used to show the same physical device was connected to a different computer.

Does formatting the USB stick remove it from the registry?

No. The record lives on the Windows machine, in that machine's registry and installation log — not on the device. Formatting, wiping, or destroying the USB stick has no effect on what the PC remembers about it.