USB Device Connection History Extraction from Windows Registry

1. The Evidentiary Role of USB Forensics in Trade Secret & Exfiltration Matters

Removable Universal Serial Bus (USB) storage devices—including thumb drives, external solid-state drives (SSDs), microSD adapters, and mobile media transfer protocol (MTP) devices—remain the primary physical vector for corporate data exfiltration, intellectual property theft, and unauthorized software introduction. In employment restrictive covenant disputes, departing employees frequently connect external storage media to copy proprietary source code, customer CRM databases, or executive financial models during their final weeks of employment.

Furthermore, in ransomware and malware intrusion incidents, unauthorized USB flash drives frequently serve as initial access delivery vectors or air-gapped staging bridges. Determining the exact lineage, hardware serial number, and user interaction timeline of an external drive is critical for containment and forensic attribution.

In federal civil litigation, forensic evidence of unauthorized USB connection often forms the core basis for emergency motions for preliminary injunctions, expedited preservation orders, and forensic imaging orders under Federal Rule of Civil Procedure 26.

When investigating suspected data theft, digital forensic examiners are tasked with answering five fundamental questions for trial counsel:

• Device Identification: What was the exact make, model, manufacturer, and unique hardware serial number of the connected storage media?
• Temporal Timeline: When was the USB device first connected to the workstation, when was it most recently connected, and when was it physically unmounted?
• User Attribution: Which logged-in Windows user account was actively authenticated when the USB volume was mounted?
• Drive Letter & Volume Mapping: What drive letter (e.g., E:\, F:\) and filesystem Volume GUID were assigned to the removable partition?
• File Interaction & Exfiltration Proof: What specific files and folders were copied to, opened from, or modified on the removable volume?
• Chain of Custody & Physical Evidence Correlation: Does the serial number recovered from registry hives match physical drives seized during discovery subpoenas?

The Windows operating system maintains an extensive, persistent historical record of every USB peripheral ever attached to the machine across multiple registry hives, setup logs, and event streams, allowing examiners to reconstruct historical connection events years after physical media was removed.

+---------------------------------------------------------------------------------------------------+
|                        WINDOWS USB FORENSIC RECONSTRUCTION WORKFLOW                               |
+---------------------------------------------------------------------------------------------------+
| 1. DEVICE IDENTIFICATION (SYSTEM HIVE):                                                           |
|   ├── SYSTEM\CurrentControlSet\Enum\USBSTOR ──► Vendor, Model, Version, Serial Number            |
|   └── SYSTEM\CurrentControlSet\Enum\USB ──► Vendor ID (VID) & Product ID (PID)                    |
+---------------------------------------------------------------------------------------------------+
                                            ▼
+---------------------------------------------------------------------------------------------------+
| 2. VOLUME & DRIVE LETTER MAPPING (SYSTEM & SOFTWARE HIVES):                                       |
|   ├── SYSTEM\MountedDevices ──► Volume GUID & Drive Letter Linkage                                |
|   └── SOFTWARE\Microsoft\Windows Portable Devices\Devices ──► Friendly Volume Label               |
+---------------------------------------------------------------------------------------------------+
                                            ▼
+---------------------------------------------------------------------------------------------------+
| 3. USER ACCOUNT ATTRIBUTION (USER NTUSER.DAT HIVES):                                              |
|   ├── NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2 ──► Volume GUID  |
|   └── UserAssist & Shellbags ──► Files Accessed on Removable Drive Letter                         |
+---------------------------------------------------------------------------------------------------+
                                            ▼
+---------------------------------------------------------------------------------------------------+
| 4. TIMELINE CORROBORATION (LOGS & EVENT STREAMS):                                                 |
|   ├── C:\Windows\INF\setupapi.dev.log ──► First Installation Timestamp                            |
|   └── Microsoft-Windows-DriverFrameworks-UserMode/Operational ──► Event 20001 (Connect) / 21006  |
+---------------------------------------------------------------------------------------------------+

Comparison Matrix: Windows USB Forensic Artifact Locations

For more on forensic execution tracking and artifact validation, explore our guides on Parsing Windows Prefetch & Shimcache for Executable Execution History and Uncovering Data Deletion & Anti-Forensics Wiping Attempts.

2. Step-by-Step Registry & Log Artifact Corroboration

To establish unassailable proof of a USB exfiltration event in court, examiners follow a disciplined multi-artifact correlation protocol:

1. Identifying the Physical Device via USBSTOR

Under SYSTEM\CurrentControlSet\Enum\USBSTOR, Windows creates subkeys for each mass storage device formatted as Disk&Ven_[Vendor]&Prod_[Product]&Rev_[Version]. Below this subkey is the device serial number key (e.g., 07072B3654404085&0). Note: If the second character of the serial is an ampersand (&), Windows generated a pseudo-unique identifier; if no ampersand is present, the string is the physical hardware serial number burned into the device firmware by the manufacturer.

Examiners also query SYSTEM\CurrentControlSet\Enum\USB to extract the USB Vendor ID (VID) and Product ID (PID) hexadecimal codes (e.g., VID_0781&PID_5583 for SanDisk Ultra Fit). Cross-referencing the VID against the USB Implementers Forum (USB-IF) official registry verifies hardware legitimacy.

2. Resolving the Drive Letter & Volume GUID in MountedDevices

The SYSTEM\MountedDevices key contains binary values linking volume GUIDs to drive letters. By parsing the binary data under \DosDevices\E: and matching the disk signature or parent serial string extracted from USBSTOR, the examiner determines the exact drive letter assigned during the exfiltration window.

Furthermore, under SOFTWARE\Microsoft\Windows Portable Devices\Devices, Windows caches human-readable volume labels (such as “John_Personal_Backup” or “KINGSTON_64GB”). Finding a personalized drive label provides powerful corroborating evidence in court regarding device ownership.

3. Proving User Attribution in NTUSER.DAT\MountPoints2

Because the SYSTEM hive records machine-wide device installations, opposing counsel may argue that another employee connected the USB drive while the custodian stepped away from their desk. To defeat this defense, examiners parse NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2 from each user’s profile. When a user mounts a removable drive in Explorer, their personal NTUSER.DAT hive logs the volume GUID. The presence of the volume GUID in the custodian’s profile—combined with active Windows session unlock timestamps—proves direct user attribution.

Additionally, examiners inspect the _AutorunStatus and BaseClass binary flags under MountPoints2 to verify whether the user engaged with automated prompts or actively launched executable binaries from the volume root.

4. Determining Precise Connection Timestamps via setupapi.dev.log

The C:\Windows\INF\setupapi.dev.log file records when Windows first detects and installs Plug and Play drivers for a new device. Searching for the device serial number reveals the exact UTC timestamp when the device was first plugged into the computer.

5. Corroborating Disconnection & Session Duration via DriverFrameworks Logs

Windows Event Log Microsoft-Windows-DriverFrameworks-UserMode/Operational.evtx captures microsecond-level telemetry of device driver state changes. Event ID 20001 logs device arrival and driver host initialization, Event ID 20003 indicates interface binding, and Event ID 21006 records device ejection or sudden physical disconnection. By calculating the delta between Event 20001 and 21006, examiners establish the exact window of opportunity during which files could have been exfiltrated.

3. Cross-Corroborating File Transfers via LNK, Jump Lists, and Shellbags

Connecting a USB drive proves opportunity, but proving trade secret exfiltration requires demonstrating file interaction. Examiners corroborate USB connection logs against:

• Windows LNK Files (Shortcuts): When a user opens a document directly from a USB drive (e.g., E:\Q2_Financials.xlsx), Windows creates an LNK shortcut file in %APPDATA%\Microsoft\Windows\Recent recording the volume serial number, volume label, drive letter, target file creation date, and MAC addresses.
• Jump Lists (AutomaticDestinations & CustomDestinations): Application Jump Lists (structured OLE CFBF compounds) record files opened in applications like Excel, Word, or Acrobat, confirming the user actively previewed and edited sensitive documents from the external storage volume.
• Shellbags (BagMRU & Bags): Registry Shellbags record folder browsing history, window positions, and folder names, proving the custodian navigated subdirectories residing solely on the removable volume (e.g., E:\Confidential_Source_Code\).
• Volume Shadow Copies (VSS): Historical shadow snapshots retain older versions of NTUSER.DAT and setupapi.dev.log, proving previous connection events even if a custodian attempts to scrub active registry keys.
• Windows Timeline (ActivitiesCache.db): SQLite database logging active user engagement times, application focus duration, and file paths opened from removable storage media.
• System Resource Usage Monitor (SRUM): Windows SRUDB.dat records network and disk byte write volumes per process, proving that gigabytes of data were written during the exact active USB connection session.

4. Production Python Windows USB Registry & MountPoints2 Forensic Parser

Below is a production-grade Python script that parses mock Windows Registry USBSTOR records, matches them against MountedDevices binary structures and user MountPoints2 hives, and generates structured forensic timeline reports:

import json
from datetime import datetime, timezone
from dataclasses import dataclass, asdict
from typing import List, Dict, Any, Optional

@dataclass
class USBDeviceEvent:
    device_id: str
    vendor: str
    product: str
    serial_number: str
    is_hardware_serial: bool
    assigned_drive_letter: str
    volume_guid: str
    attributed_user: str
    first_connected_utc: str
    last_write_utc: str

class USBRegistryForensicParser:
    def parse_usbstor_record(
        self,
        usbstor_key: str,
        serial_raw: str,
        mounted_devices_map: Dict[str, str],
        user_mountpoints_map: Dict[str, str],
        setupapi_timestamp: str,
        reg_lastwrite: str
    ) -> USBDeviceEvent:
        # Example key: Disk&Ven_SanDisk&Prod_Ultra&Rev_1.00
        parts = usbstor_key.split("&")
        ven = parts[1].replace("Ven_", "") if len(parts) > 1 else "Unknown"
        prod = parts[2].replace("Prod_", "") if len(parts) > 2 else "Unknown"

        # Check serial uniqueness: if '&' in second char -> OS generated
        clean_serial = serial_raw.split("&")[0]
        is_hw = not (len(serial_raw) > 1 and serial_raw[1] == "&")

        drive_letter = mounted_devices_map.get(clean_serial, "Unassigned")
        vol_guid = mounted_devices_map.get(f"{clean_serial}_guid", "Unknown")
        attributed_user = user_mountpoints_map.get(vol_guid, "SYSTEM / Unmapped")

        return USBDeviceEvent(
            device_id=usbstor_key,
            vendor=ven,
            product=prod,
            serial_number=clean_serial,
            is_hardware_serial=is_hw,
            assigned_drive_letter=drive_letter,
            volume_guid=vol_guid,
            attributed_user=attributed_user,
            first_connected_utc=setupapi_timestamp,
            last_write_utc=reg_lastwrite
        )

# Production Verification Demonstration
if __name__ == "__main__":
    parser = USBRegistryForensicParser()

    mounted_devices = {
        "4C530001280424119173": "E:\\",
        "4C530001280424119173_guid": "{a24f8b10-67c2-11eb-8902-806e6f6e6963}"
    }

    user_mountpoints = {
        "{a24f8b10-67c2-11eb-8902-806e6f6e6963}": "C:\\Users\\JohnDoe"
    }

    event = parser.parse_usbstor_record(
        usbstor_key="Disk&Ven_SanDisk&Prod_Ultra_Fit&Rev_1.00",
        serial_raw="4C530001280424119173&0",
        mounted_devices_map=mounted_devices,
        user_mountpoints_map=user_mountpoints,
        setupapi_timestamp="2026-08-10T14:30:15Z",
        reg_lastwrite="2026-08-15T09:12:44Z"
    )

    print(f"Parsed USB Forensic Event:\n{json.dumps(asdict(event), indent=2)}")

Automated registry parsing scripts empower forensic examiners to rapidly reconstruct complex USB connection histories, establishing unassailable factual timelines for trade secret litigation. By cross-referencing programmatic outputs with volume GUID mapping, forensic examiners generate definitive exhibits that defeat common defense arguments alleging device misattribution or shared machine access.

5. Conclusion & Key Takeaways

The Windows operating system preserves an extensive, multi-layered trail of USB peripheral connectivity. By correlating the SYSTEM\Enum\USBSTOR device key, MountedDevices volume records, NTUSER.DAT\MountPoints2 user attribution hives, and setupapi.dev.log timestamps, digital forensic examiners can definitively prove device identity, connection durations, drive letter mapping, and specific user responsibility in data exfiltration disputes.

Key strategic takeaways for forensic examiners, incident responders, and trial counsel include:

1. Extract Device Make, Model, and Serial: Query SYSTEM\CurrentControlSet\Enum\USBSTOR to retrieve manufacturer details and firmware-burned hardware serials.
2. Distinguish Hardware vs. OS-Generated Serials: Check for an ampersand (&) in the second character position of the serial string to identify OS-generated IDs.
3. Map Assigned Drive Letters via MountedDevices: Correlate volume GUID binary values to determine the exact drive letter (e.g., E:\) mounted during the incident.
4. Attribute Connection to Specific User Profiles: Inspect NTUSER.DAT\MountPoints2 to prove the custodian personally mounted the volume in their active desktop session.
5. Establish First Connection Timestamps in setupapi.dev.log: Interrogate Plug and Play staging logs to identify the exact second the USB device was first introduced.
6. Corroborate Active Connection Duration via Event Logs: Analyze Microsoft-Windows-DriverFrameworks-UserMode/Operational Event IDs 20001 and 21006.
7. Investigate Shellbags for Removable Folder Browsing: Prove the user navigated directory structures residing on the external volume.
8. Examine LNK Files for Document Openings: Extract volume serial numbers, paths, and timestamps from recent shortcut files to prove data was accessed.
9. Correlate with Windows Defender Operational Logs: Check Defender Event ID 1116/1117 to verify if automated anti-malware scans scanned the USB drive upon insertion.
10. Maintain Methodological Integrity for FRE 702 Admissibility: Document all registry hive parsing offsets and validation scripts in formal expert reports.
11. Audit USB Storage Policies under Group Policy (GPO): Check whether removable storage write restrictions were enforced or bypassed during the exfiltration timeframe.
12. Prepare Clear Visual Timelines for Courtroom Presentation: Present side-by-side matrices linking badge swipe access, workstation unlock events, USB insertion, and document copying.

6. Frequently Asked Questions (FAQ)