Analyzing USB Device Connection History

When to Use

• When investigating potential data exfiltration via removable storage devices
• During insider threat investigations to track USB device usage
• For compliance audits verifying removable media policy enforcement
• When correlating USB connections with file access and copy events
• For establishing a timeline of device connections during an incident

Prerequisites

• Forensic image or extracted registry hives and event logs
• Access to SYSTEM, SOFTWARE, and NTUSER.DAT registry hives
• SetupAPI logs (setupapi.dev.log)
• Windows Event Logs (System, Security, DriverFrameworks-UserMode)
• USBDeview, USB Forensic Tracker, or RegRipper
• Understanding of USB device identification (VID, PID, serial number)

Workflow