The Registry contains information regarding specific
devices, to include the serial number of the device
(if it has one), and the last time the device was
connected. For the first time the device was
connected, check the setupapi.log file.
--- Detection Services - IS Security <[EMAIL PROTECTED]>
wrote:
> System Event log,
> Source = "Removable Storage"
> Event IDs = 134 - insertion.
> 135 - removal
>
> The Description field includes device specifics:
>
> Received a device interface ARRIVAL notification for
> device:
>
>
\\?\USBSTOR#Disk&Ven_&Prod_&Rev_1.89#254F11FE40F7437B&0#{53f56307-b6bf-1
> 1d0-94f2-00a0c91efb8b}
>
> This seems to be specific to the device.
>
> Q: can anyone shed light on tracing this back to a
> specific USB hardware
> device?
>
> > -----Original Message-----
> > From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]
> > Sent: Monday, May 08, 2006 5:43 PM
> > To: [email protected]
> > Subject: USB device installation problem
> >
> >
> > Hello All,
> >
> > Currently, USB usage becomes one of the most
> important part
> > in Windows systems. If I would like to check how
> many USB
> > external storage has been inserted to the computer
> before and
> > when is they have been inserted and removed, is
> there any way
> > I can check that from registry? or is there any
> other
> > location I can find that?
> >
> > Please advise.
> >
> > Thx.
> >
> > Ricci
> >
> >
> >
>
--------------------------------------------------------------
> > -------------
> >
>
--------------------------------------------------------------
> > -------------
> >
> >
>
>
---------------------------------------------------------------------------
>
---------------------------------------------------------------------------
>
>
------------------------------------------
Harlan Carvey, CISSP
"Windows Forensics and Incident Recovery"
http://www.windows-ir.com
http://windowsir.blogspot.com
------------------------------------------
---------------------------------------------------------------------------
---------------------------------------------------------------------------
