USB and external devices

When data leaves an organization on a USB drive, the examiner must answer three questions: which device was connected, when it was connected, and which user worked with it. No single artifact answers all three. Windows 10 and 11 spread the evidence across the SYSTEM, SOFTWARE and NTUSER.DAT hives, a plain-text setup log and several event logs. This lesson shows where each value lives and how to chain them together, ending at the volume serial number in the USB image itself. That chain is central to the CFX exam, whose questions often describe a Windows triage collection and an E01 image of a USB drive.

Before you start: the control set

An offline SYSTEM hive has no CurrentControlSet. That name is a link that exists only on a running system. Read SYSTEM\Select\Current first. A value of 1 means ControlSet001 is the active set. All SYSTEM paths in this lesson assume ControlSet001. Convert local times with the time zone settings you recorded in Lesson 2.2.

Identifying the device: USBSTOR and USB

Every USB mass storage device that Windows has set up gets a two-level entry under SYSTEM\ControlSet001\Enum\USBSTOR:

• Device class key: Disk&Ven_<vendor>&Prod_<product>&Rev_<rev>, for example Disk&Ven_SanDisk&Prod_Cruzer_Blade&Rev_1.00. Vendor and product here are the strings the device reports, not registered IDs.
• Instance key: <serial>&<n>, for example 4C530001230411109384&0. The part before the last & is the device's serial number (the USB iSerialNumber string). The trailing number is the logical unit number (LUN), normally 0, that Windows adds.

The instance key's FriendlyName value holds a readable name such as SanDisk Cruzer Blade USB Device.

The serial number trap. If the second character of the instance ID is &, as in 7&2c1f9a3e&0, the device reported no unique serial number. Windows generated the ID itself, partly from the port the device was attached to. It is not a hardware serial, it cannot be matched to a physical device, and the same drive may produce a different ID on another port. Report it as a Windows-generated instance ID, never as a serial number.

The same device also appears under SYSTEM\ControlSet001\Enum\USB\VID_xxxx&PID_yyyy\<serial>. VID and PID are the 16-bit vendor and product IDs in hex, for example VID_0781&PID_5567 for a SanDisk Cruzer Blade. Here the instance name is the serial without the &0 suffix, so the serial string is what links the USB and USBSTOR entries. USB drives that use the UASP protocol are often enumerated under Enum\SCSI rather than Enum\USBSTOR, so search both.

Device timestamps in the Properties key

The instance key holds the most precise device times, in Properties\{83da6326-97a6-4088-9453-a1923f573b29}\. Each subkey is a property ID in hex. Its value is an 8-byte FILETIME, which counts 100-nanosecond intervals since 1601-01-01 UTC.

Some published cheat sheets label 0064 as "first install". The Windows SDK header devpkey.h defines property 100 (0x64) as InstallDate and 101 (0x65) as FirstInstallDate. For a USB drive the two values are usually equal, so check both and cite the subkey you used. On a live system the Properties key is normally readable only by SYSTEM, so a registry editor running as Administrator may be denied access. Offline, any hive parser such as RECmd or Registry Explorer reads it directly.

Drive letter and volume: MountedDevices

SYSTEM\MountedDevices maps names to volumes with two kinds of values:

• \DosDevices\E: holds the volume most recently assigned the letter E:.
• \??\Volume{GUID} holds one entry per volume the Mount Manager has seen. The volume GUID is persistent for that volume on this system.

The binary data identifies the volume. For removable media it is a UTF-16LE string containing the device path, for example _??_USBSTOR#Disk&Ven_SanDisk&Prod_Cruzer_Blade&Rev_1.00#4C530001230411109384&0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}. The serial in that string ties the volume GUID to the USBSTOR instance. For an MBR fixed disk, such as many USB hard drives, the data is 12 bytes: the 4-byte disk signature followed by the 8-byte partition starting offset in bytes. GPT partitions store DMIO:ID: followed by the partition GUID.

Drive letters are reused. Every new drive can become E:, and \DosDevices\E: keeps only the last one. A path such as E:\Plans\budget.xlsx proves nothing about which device was meant. The letter is weak evidence until a volume serial number confirms it.

Linking the device to a user: MountPoints2

Each user's NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2 contains a subkey named {volume GUID} for every volume that appeared in that user's session. If the GUID matches a \??\Volume{GUID} value in MountedDevices, the device was mounted while that user was logged on. The NTUSER.DAT you found it in identifies the account. The subkey's LastWrite time indicates recent activity involving the volume in that user's session. Treat it as supporting evidence, because other activity can also update a key's LastWrite time (Lesson 2.1). MountPoints2 also lists network shares, as subkeys such as ##server#share.

Volume labels in the SOFTWARE hive

Two SOFTWARE keys can recover a volume label, such as "WORK", that the SYSTEM hive does not record:

• SOFTWARE\Microsoft\Windows Portable Devices\Devices\<device path containing the serial>: the FriendlyName value is often the volume label, or the drive letter if the volume had no label.
• SOFTWARE\Microsoft\Windows Search\VolumeInfoCache\<drive letter>: holds the label of the volume last seen at that letter. Like MountedDevices, it is indexed by letter and overwritten.

Neither key is populated for every device, so use them to corroborate, not as primary evidence.

setupapi.dev.log: first installation

C:\Windows\INF\setupapi.dev.log is a text log of driver installations. The first time a device is connected, Windows writes a block like this:

>>> [Device Install (Hardware initiated) - USBSTOR\Disk&Ven_SanDisk&Prod_Cruzer_Blade&Rev_1.00\4C530001230411109384&0]

>>> Section start 2026/03/10 14:22:06.120

The Section start time is the first installation, which is effectively the first connection. It is in local system time with no zone marker, so you must convert it to UTC. Later connections of the same device do not create new install blocks. Older entries move to rotated files such as setupapi.dev.yyyymmdd_hhmmss.log in the same folder.

Event logs

• Microsoft-Windows-Partition/Diagnostic, Event ID 1006 (Microsoft-Windows-Partition%4Diagnostic.evtx, Windows 10 and 11): logged when a disk arrives or leaves. It records Manufacturer, Model, Revision, SerialNumber and Capacity, the partition style and table, and raw copies of the MBR (Mbr) and of up to four volume boot records (Vbr0 to Vbr3). Disconnection events show a capacity of 0 and no partition data. The 1006 event ties the hardware serial to a file system, because the volume serial number can be read from the Vbr bytes. The event survives after the device is gone.
• Microsoft-Windows-Kernel-PnP/Configuration: Event ID 400 (device configured), 410 (device started) and 420 (device deleted) name the device instance ID, including the serial, and corroborate connection times.
• Microsoft-Windows-DriverFrameworks-UserMode/Operational: Event IDs 2003 and 2100 to 2102 record connection and removal, but the channel is disabled by default on Windows 10 and 11. Do not expect it, and do not treat its absence as meaningful.

The volume serial number chain

A file system writes a volume serial number (VSN) into its volume boot record (VBR) when the volume is formatted. All offsets below are relative to the start of the volume, and values are little-endian:

The same number appears in three places. The first is the VBR in the USB image. The second is the LinkInfo VolumeID of LNK files and Jump Lists on the host (Lesson 2.4), next to the drive type (removable) and the original path. The third is the Vbr0 copy in Partition/Diagnostic 1006. A fourth link, the USBSTOR serial, ties them to the hardware through that event's SerialNumber field. If an LNK file in C:\Users\ana\... points to E:\Plans\budget.xlsx with VSN 1A2B3C4D, and the E01's VBR holds the same VSN, then the file was opened from that volume. It was not opened from some other drive that also used the letter E:. One limit applies: reformatting creates a new VSN, so a match identifies a particular format of the media, which the hardware serial then ties to the physical device.

Worked example: one device, end to end

The time zone settings (Lesson 2.2) show E. South America Standard Time with ActiveTimeBias = 180 minutes, so UTC = local + 3 hours.

1. Select\Current = 1. ControlSet001\Enum\USBSTOR\Disk&Ven_SanDisk&Prod_Cruzer_Blade&Rev_1.00\4C530001230411109384&0 exists. The second character is C, so the serial is real: 4C530001230411109384. Enum\USB\VID_0781&PID_5567\4C530001230411109384 confirms it.
2. MountedDevices: the value \??\Volume{a9d9c980-1ca5-11f1-a3d2-806e6f6e6963} contains ...#4C530001230411109384&0#..., and \DosDevices\E: holds the same data.
3. C:\Users\ana\NTUSER.DAT contains MountPoints2\{a9d9c980-1ca5-11f1-a3d2-806e6f6e6963}, so the volume was mounted in ana's session.
4. setupapi.dev.log: Section start 2026/03/10 14:22:06.120 local. Adding 3 hours gives 2026-03-10T17:22:06.120Z. 0065 holds bytes 00 A0 2F 6C B2 B0 DC 01, which decode to 2026-03-10T17:22:08Z and corroborate the setupapi time within seconds.
5. 0066 holds bytes 80 70 DD BD B9 B3 DC 01. Read little-endian, that is 0x01DCB3B9BDDD7080 = 134,179,699,250,000,000 intervals of 100 ns. Divided by 10,000,000, that is 13,417,969,925 s since 1601. Subtracting 11,644,473,600 s gives Unix time 1,773,496,325, which is 2026-03-14T13:52:05Z (last arrival).
6. Partition/Diagnostic 1006 at 2026-03-14T13:52:06Z shows SerialNumber 4C530001230411109384 and a partition starting at LBA 2048. Bytes 0x43 to 0x46 of Vbr0 are 4D 3C 2B 1A.
7. In the E01, the partition starts at 2,048 × 512 = 1,048,576 bytes. The FAT32 VSN at 1,048,576 + 0x43 is 4D 3C 2B 1A, that is 0x1A2B3C4D, displayed as 1A2B-3C4D. fsstat -o 2048 usb.E01 reports the same Volume ID.
8. ana's Recent folder contains budget.xlsx.lnk with drive type removable, serial 1A2B3C4D and path E:\Plans\budget.xlsx.

Exam-style answers: serial number 4C530001230411109384 (without &0); first connection 2026-03-10T17:22:06Z.

Summary table

Exam focus: Expect questions that ask for a USB serial number, which must be the hardware serial and not a Windows-generated & ID, and for a first or last connection time in UTC. The setupapi time must be converted from local time. Be ready to show how to prove that a file opened from a drive letter came from a given USB image by matching the VSN in the image's VBR to the LNK file and the 1006 event.

Key points

• Resolve SYSTEM\Select\Current first, then read Enum\USBSTOR and Enum\USB. An instance ID whose second character is & is generated by Windows, not a serial.
• Properties\{83da6326-...}: 0065 first install, 0066 last arrival, 0067 last removal, all FILETIME in UTC. setupapi.dev.log gives the first install in local time.
• MountedDevices links the serial to a volume GUID and a letter. MountPoints2 in NTUSER.DAT links that GUID to a user.
• Drive letters are reused, so the volume serial number (NTFS 0x48, FAT32 0x43, exFAT 0x64) is what ties LNK paths to a specific volume.
• Partition/Diagnostic 1006 records the hardware serial and a VBR copy, bridging the device and its file system. DriverFrameworks-UserMode is off by default.