USB Device History (USBSTOR / MountPoints2)
Location
SYSTEM\CurrentControlSet\Enum\USBSTOR and NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2Description
Registry keys recording USB mass storage device connections. USBSTOR stores device vendor, product, serial number, and connection timestamps. MountPoints2 records user-specific drive letter mappings for mounted devices.
Forensic Value
USB device history is critical for data exfiltration and insider threat investigations. USBSTOR entries prove a specific USB device (by serial number) was connected to the system with first and last connection timestamps. MountPoints2 provides user attribution showing which account accessed the device. Cross-referencing device serial numbers across multiple systems maps the path of a USB device through the environment. Combined with file access artifacts, this proves what data was transferred to removable media.
Tools Required
Collection Commands
KAPE
kape.exe --tsource C: --tdest C:\output --target RegistryHives
RegRipper
rip.exe -r C:\output\SYSTEM -p usbstor
USBDeview
USBDeview.exe /scomma C:\output\usb_devices.csv
Registry Explorer
Open SYSTEM hive and navigate to ControlSet001\Enum\USBSTOR for device details
Collection Constraints
- •Availability, retention, and field coverage depend on the Windows release, SKU, per-host audit policy, and user activity. Treat absence as inconclusive unless you verified the feature was enabled.