RE: USB device installation problem

The Registry contains information regarding specific
devices, to include the serial number of the device
(if it has one), and the last time the device was
connected. For the first time the device was
connected, check the setupapi.log file.

--- Detection Services - IS Security <secdet@xxxxxxx>
wrote:

System Event log,
Source = "Removable Storage"
Event IDs = 134 - insertion.
135 - removal

The Description field includes device specifics:

Received a device interface ARRIVAL notification for
device:


\\?\USBSTOR#Disk&Ven_&Prod_&Rev_1.89#254F11FE40F7437B&0#{53f56307-b6bf-1
1d0-94f2-00a0c91efb8b}

This seems to be specific to the device.

Q: can anyone shed light on tracing this back to a
specific USB hardware
device?

-----Original Message-----
From: ricci@xxxxxxxxx [mailto:ricci@xxxxxxxxx]
Sent: Monday, May 08, 2006 5:43 PM
To: focus-ms@xxxxxxxxxxxxxxxxx
Subject: USB device installation problem


Hello All,

Currently, USB usage becomes one of the most
important part
in Windows systems. If I would like to check how
many USB
external storage has been inserted to the computer
before and
when is they have been inserted and removed, is
there any way
I can check that from registry? or is there any
other
location I can find that?

Please advise.

Thx.

Ricci




--------------------------------------------------------------
-------------


--------------------------------------------------------------
-------------




---------------------------------------------------------------------------

---------------------------------------------------------------------------




------------------------------------------
Harlan Carvey, CISSP
"Windows Forensics and Incident Recovery"
http://www.windows-ir.com
http://windowsir.blogspot.com
------------------------------------------

---------------------------------------------------------------------------
---------------------------------------------------------------------------

Relevant Pages

  • Re: Ext USB HDD appearing as Hard Disk drive instead of Removable Stor
    ... "Devices with Removable Storage" means a fixed drive with ... USB hard drives could do the same but usually they don't. ... But whenevwe I connect the ext hard disk, it appears under "Hard Disk Drives" instead of under "Devices with Removable Storage". ...
    (microsoft.public.windowsxp.general)
  • Re: Can Humax PVR9200T store normal data files?
    ... would it have cost to make it appear as a removable storage ... IOW not in the case of a PVR, ... Are you so naive to think that all those USB portable hard drives can only read, and write independently at different times and need a complete system reboot in between to do the other. ...
    (uk.tech.digital-tv)
  • Re: interfacing USB flash disk
    ... This is a personal view which may or may not be share by my Employer Atmel Nordic AB "Tim Mitchell" skrev i meddelandet ... > I am designing a microcontroller based device which needs to connect to> PC, probably by USB, and also needs some removable storage. ... But then I wondered about using> the USB flash disks you can get. ...
    (comp.arch.embedded)
  • Re: interfacing USB flash disk
    ... > PC, probably by USB, and also needs some removable storage. ... I have written a USB mass storage bulk-only ... Different devices support different sub-sets of SCSI ...
    (comp.arch.embedded)
  • usb 2.0 recognition
    ... >recognised in device manager but not in usb. ... >will not show in removable storage. ... >Go to critical updates and try downloading the most ...
    (microsoft.public.windowsxp.hardware)