Lion Cipher Lab

Trace USB device history from the Windows registry — who plugged in what, and when

• Digital Forensics & IR (DFIR)
• Intermediate
• ~50 min
• Free · no account required

Why it matters

The single most common data-loss question an investigator is handed is 'was this copied to a USB stick?' — the departing employee, the leaked customer list, the file that turned up somewhere it should not have. That headline question is hard to answer directly, but it decomposes into a narrower one the operating system answers for you almost perfectly: WHICH removable mass-storage devices were ever connected to this machine, when were they first plugged in, which user account mounted them, and what drive letter did each receive. Windows keeps meticulous records here for an entirely mundane…

What you'll learn

• explaining in plain words what the Windows registry, a hive, a key/value and a key's LastWrite time are, before touching any of them
• naming the exact keys USB forensics relies on and what each one answers: SYSTEM\CurrentControlSet\Enum\USBSTOR and \USB (the device was enumerated), MountedDevices and the per-user NTUSER.DAT MountPoints2 (which drive letter, tied to which account), and SOFTWARE\Microsoft\Windows Portable Devices (the friendly name)
• recovering a device's VID (vendor id), PID (product id) and SERIAL from the USBSTOR key, and reading the serial correctly — including what an '&' in the second character means
• correlating the registry with C:\Windows\INF\setupapi.dev.log to establish the FIRST-connected timestamp, and knowing why that differs from a key's LastWrite time
• establishing ground truth by plugging in a USB stick you own, recovering its serial from the registry, and confirming it matches the physical label
• proving the headline property: unplug the device, re-query, and show the history PERSISTS — connection evidence that outlives the connection
• distinguishing three separate claims that are constantly conflated: a device was ENUMERATED vs a user MOUNTED and USED it vs files were COPIED — and knowing the registry proves the first two, never the third
• stating the honest limits: the registry shows connection history not file transfer; timestamps have caveats; anti-forensics can wipe the keys; a shared machine muddies 'who'; and pointing to the complementary artifacts ($MFT, USN journal, jump lists, shellbags) that finish the story

Steps in this lab

1. From zero: the registry, a hive, a key's LastWrite, and the question we're answering
2. Establish ground truth: plug in a stick you own and read its label
3. USBSTOR: recover the vendor, product and serial — and read the serial correctly
4. The friendly name and the USB (not USBSTOR) view
5. Drive letter and WHO: MountedDevices and the per-user MountPoints2
6. WHEN: setupapi.dev.log for the first-connect time (and the LastWrite caveat)
7. The headline: unplug the device, re-query, and watch the history survive
8. The judgment call: ENUMERATED vs MOUNTED vs COPIED — three different claims
9. Honest limits, anti-forensics, and where to go next

Open the full interactive lab →