# USB Device History on Windows 11: What the Registry Proves URL: https://www.mytechnician.tech/labs/usb-device-history-windows-11-registry-setupapi/ Published: 2026-08-08 | Author: Ankit Kumar Track: Forensic artifact | Difficulty: Beginner | Authorization: defensive Time required: 25 min Verified on: Windows 11 24H2 (build 26100.2894), Hyper-V VM on an internal-only virtual switch MITRE ATT&CK: T1052.001 Tags: Forensics, USB, Registry, Windows 11 Summary: Windows keeps a permanent record of every USB storage device ever attached, including serial numbers and first-connect times. Here is where it lives on Windows 11 and how to read it. ## What Windows Remembers Plug a USB stick into a Windows machine once, and the machine keeps a record of it — the vendor, the product, and usually the **device's own serial number** — indefinitely. Removing the device does not remove the record. Neither does a normal cleanup. This is why USB history answers questions nothing else can: *was data copied off this machine*, *was this specific stick ever in this specific PC*, *when did the device first appear*. ## The Four Sources Read them together. Each holds a piece, and the serial number is what joins them. ### USBSTOR — the device list ``` HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR ``` One key per device model, then one subkey per individual device. The subkey name is the pattern: ``` Disk&Ven_SanDisk&Prod_Cruzer_Blade&Rev_1.00\4C530001120523118440&0 ``` That long value is the **device serial number**, assigned by the manufacturer and burned into the device. It is what makes this identification rather than description. One caveat that matters: if the second character of the serial is `&`, the device does **not** report a serial and Windows generated that value itself. Such a value is unique to this machine and cannot be used to prove the same physical device appeared on another PC. Under each device key, the `Properties` subkey holds timestamps. The GUID-named values there include first install, last arrival, and last removal times. Registry Explorer decodes these; Registry Editor shows them as raw binary. ### setupapi.dev.log — first connection, in plain text ``` C:\Windows\INF\setupapi.dev.log ``` A plain-text device installation log. When a USB device is attached for the first time, Windows installs its driver and writes a block here, timestamped. ``` >>> [Device Install (Hardware initiated) - SWD\WPDBUSENUM\...] >>> Section start 2026/08/06 14:22:19.113 ``` Search the file for the serial number you pulled from USBSTOR. The `Section start` line immediately above it is your **first-connect time** for that device on this machine. This log is not rotated aggressively, so it frequently reaches back much further than the event log does — often to the original Windows installation. ### MountedDevices — which drive letter it got ``` HKLM\SYSTEM\MountedDevices ``` Maps drive letters and volume GUIDs to the underlying device. Look for `\DosDevices\E:` and similar. The binary value contains the device identifier, and the serial number is readable inside it as text. This connects the physical device to a **drive letter**, which is what you need to interpret any other artifact that recorded a path like `E:\`. ### The per-user mount record ``` HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2 ``` Per-user, so this is the artifact that provides **attribution**. USBSTOR is machine-wide and cannot tell you which account was logged in. `MountPoints2` sits in that user's `NTUSER.DAT`, so its presence establishes that this specific profile had the volume mounted. ### Step 1: Enumerate the devices ``` reg query "HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR" /s | Select-String "Disk&Ven" ``` Write down vendor, product, and serial for each. This is your device list. ### Step 2: Date each device's first connection For each serial, search the installation log: ``` Select-String -Path C:\Windows\INF\setupapi.dev.log -Pattern "4C530001120523118440" -Context 4,0 ``` The `Section start` timestamp in the preceding lines is the first connect. ### Step 3: Resolve drive letters ``` reg query HKLM\SYSTEM\MountedDevices ``` Match the serial inside the binary values to a `\DosDevices\:` entry. Now you know that when another artifact references `F:\`, it meant this device. ### Step 4: Attribute to a user For each user profile, load `C:\Users\\NTUSER.DAT` in Registry Explorer and check `Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2` for the volume GUID from the previous step. ### Step 5: Establish what was actually accessed Device history proves a device was attached. It does not prove a file was copied. For that, move to the artifacts that record file access: - **[LNK files and Jump Lists](https://www.mytechnician.tech/labs/windows-11-forensic-artifacts-program-execution/)** — `C:\Users\\AppData\Roaming\Microsoft\Windows\Recent\` — record the target path *and* the volume serial number of the drive the file lived on. A `.lnk` pointing at `F:\report.docx` with a matching volume serial is direct evidence a file on that device was opened. - **Shellbags** — prove a folder on the device was browsed in Explorer. - **Prefetch** — if a program ran *from* the device, its `.pf` file records the source directory. ## Limits **No file copy record.** Windows does not log file copies natively. USB history plus LNK files plus Shellbags builds a strong circumstantial case; none of it is a copy log. **Generated serials are machine-local.** The `&` in the second character tells you the serial was assigned by Windows, not the device. Cross-machine correlation is impossible for those. **USBSTOR covers mass storage only.** Phones in MTP mode, cameras, and USB devices that are not disks appear under `HKLM\SYSTEM\CurrentControlSet\Enum\USB` and `WPDBUSENUM` instead. A phone plugged in for charging that was used for file transfer will not be in USBSTOR. ## Related - [Windows 11 forensic artifacts overview](https://www.mytechnician.tech/labs/windows-11-forensic-artifacts-program-execution/) - [30-minute triage of a suspected-compromised PC](https://www.mytechnician.tech/labs/triage-compromised-windows-11-pc-30-minutes/) - Consumer guide: [wiping a PC before selling or donating it](https://www.mytechnician.tech/tips/wipe-pc-before-selling-donating/) — this is what a buyer could otherwise recover ## FAQ ### Does Windows record every USB device ever plugged in? Every USB mass-storage device, effectively permanently, in `USBSTOR`. Non-storage devices are recorded elsewhere (`Enum\USB`, `WPDBUSENUM`) with less detail. There is no automatic expiry — records from years ago routinely survive on machines that have not been reinstalled. ### Can I tell what files were copied to a USB drive? Not directly. Windows has no native file-copy log. You can build a strong circumstantial case from LNK files (which record the target path and the source volume's serial number), Shellbags (folders browsed), and Jump Lists (files opened per application) — but none of those is proof of a copy operation. ### What does the "&" in a USB serial number mean? If the second character of the serial is `&`, the device did not report a serial number and Windows generated the value itself. That generated value is unique to this machine only, so it cannot be used to show the same physical device was connected to a different computer. ### Does formatting the USB stick remove it from the registry? No. The record lives on the Windows machine, in that machine's registry and installation log — not on the device. Formatting, wiping, or destroying the USB stick has no effect on what the PC remembers about it. --- Source: https://www.mytechnician.tech/labs/usb-device-history-windows-11-registry-setupapi/ — My Technician Security Labs. Authorization: defensive. This write-up is published for defensive and educational use on systems you own or are authorized to test. More labs: https://www.mytechnician.tech/labs/