RE: USB device installation problem



The Registry contains information regarding specific
devices, to include the serial number of the device
(if it has one), and the last time the device was
connected. For the first time the device was
connected, check the setupapi.log file.

--- Detection Services - IS Security <secdet@xxxxxxx>
wrote:

System Event log,
Source = "Removable Storage"
Event IDs = 134 - insertion.
135 - removal

The Description field includes device specifics:

Received a device interface ARRIVAL notification for
device:


\\?\USBSTOR#Disk&Ven_&Prod_&Rev_1.89#254F11FE40F7437B&0#{53f56307-b6bf-1
1d0-94f2-00a0c91efb8b}

This seems to be specific to the device.

Q: can anyone shed light on tracing this back to a
specific USB hardware
device?

-----Original Message-----
From: ricci@xxxxxxxxx [mailto:ricci@xxxxxxxxx]
Sent: Monday, May 08, 2006 5:43 PM
To: focus-ms@xxxxxxxxxxxxxxxxx
Subject: USB device installation problem


Hello All,

Currently, USB usage becomes one of the most
important part
in Windows systems. If I would like to check how
many USB
external storage has been inserted to the computer
before and
when is they have been inserted and removed, is
there any way
I can check that from registry? or is there any
other
location I can find that?

Please advise.

Thx.

Ricci




--------------------------------------------------------------
-------------


--------------------------------------------------------------
-------------




---------------------------------------------------------------------------

---------------------------------------------------------------------------




------------------------------------------
Harlan Carvey, CISSP
"Windows Forensics and Incident Recovery"
http://www.windows-ir.com
http://windowsir.blogspot.com
------------------------------------------

---------------------------------------------------------------------------
---------------------------------------------------------------------------