Michael and Ricci, USB storage devices are listed under HKLM\System\CurrentControlSet\Enum\USBStor
--- [EMAIL PROTECTED] wrote: > Windows records each device plugged into the USB > interface in the > registry key > HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB. > There > you will see a series of keys which names like > Vid_049f&Pid_0056. The > key underneath will have a DESC entry which will > describe the device's > friendly name. > > As far as listing when and how many times they have > been inserted, I > don't know anywhere that is listed. > > -----Original Message----- > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] > Sent: Monday, May 08, 2006 6:43 PM > To: [email protected] > Subject: USB device installation problem > > Hello All, > > Currently, USB usage becomes one of the most > important part in Windows > systems. If I would like to check how many USB > external storage has been > inserted to the computer before and when is they > have been inserted and > removed, is there any way I can check that from > registry? or is there > any > other location I can find that? > > Please advise. > > Thx. > > Ricci > > > ------------------------------------------------------------------------ > --- > ------------------------------------------------------------------------ > --- > > > --------------------------------------------------------------------------- > --------------------------------------------------------------------------- > > ------------------------------------------ Harlan Carvey, CISSP "Windows Forensics and Incident Recovery" http://www.windows-ir.com http://windowsir.blogspot.com ------------------------------------------ --------------------------------------------------------------------------- ---------------------------------------------------------------------------
