Drive Letter and Volume Name

This information can be used to trace file access, transfer activities, and to identify specific devices used during a session. The methods to discover this information vary across different versions of Windows.

Key Identification

Artifact Locations

• XP

  • USBSTOR for ParentIdPrefix: SYSTEM\CurrentControlSet\Enum\USBSTOR

  • MountedDevices for Last Mount Point: SYSTEM\MountedDevices

• Windows 7 and Above

  • Windows Portable Devices: SOFTWARE\Microsoft\Windows Portable Devices\Devices

  • MountedDevices for Drive Letters: SYSTEM\MountedDevices

  • VolumeInfoCache for Last USB Drive Letter: SOFTWARE\Microsoft\Windows Search\VolumeInfoCache

Critical Information

• The ParentIdPrefix found under USBSTOR is essential for identifying the device in MountedDevices.

• In Windows XP, the ParentIdPrefix is used to find the last mount point via SYSTEM\MountedDevices.

• For Windows 7 and newer versions, additional locations such as Windows Portable Devices and VolumeInfoCache offer insights into device connections.

• MountedDevices contains mappings for drive letters to volume names, useful for identifying the last known drive letter assigned to a USB device.

• The VolumeInfoCache key may only reveal the last USB device mapped to a specific drive letter, without historical records.

Overview

Drive Letter and Volume Name Association

The association between USB devices and their drive letters or volume names involves examining specific Registry keys that record these mappings. This process can help in identifying where a USB device was recognized in the system's file structure during its last connection.

Windows XP

In Windows XP, the process involves two steps:

1. Identify the ParentIdPrefix: Locate the device's ParentIdPrefix in SYSTEM\CurrentControlSet\Enum\USBSTOR.

2. Discover the Last Mount Point: Use the ParentIdPrefix to search in SYSTEM\MountedDevices for corresponding entries that indicate the last drive letter and volume name used by the device.

Windows 7 and Newer

For Windows 7 and newer versions, the analysis includes additional Registry keys:

• Windows Portable Devices: This key offers information on portable devices, including USB drives, connected to the system.

• MountedDevices: Similar to XP, this key provides mappings for drive letters to volume names. Analysts look for a serial number match within the value data to identify the drive letter used by a USB device.

• VolumeInfoCache: Offers details on the volume information of the last USB device mapped to a specific drive letter. Unlike MountedDevices, this key does not provide historical mapping records.

Analyzing The Artifact

1. For Windows XP:

   • Retrieve the ParentIdPrefix from USBSTOR.

   • Search SYSTEM\MountedDevices using the ParentIdPrefix to find the device's last mount point.

2. For Windows 7+:

   • Inspect SOFTWARE\Microsoft\Windows Portable Devices\Devices for device entries.

   • Review SYSTEM\MountedDevices for drive letter mappings, looking for serial number matches.

   • Check SOFTWARE\Microsoft\Windows Search\VolumeInfoCache for the last drive letter associated with a USB device.

Tools for Analysis

• RegRipper: Can automate the extraction of drive letter associations from the Registry.

• Windows Registry Editor (regedit): Manually navigate the Registry to find the relevant keys and values.

• Forensic Tools: Tools like FTK or EnCase can search the Registry within a forensic image to find these artifacts.

Practical Use Case

In an investigation involving unauthorized data transfer, identifying the drive letter and volume name associated with a USB device can help track the movement of files to and from the device. By correlating this information with file access logs and timestamps, forensic analysts can construct a timeline of events, potentially identifying malicious activity or policy violations.

This detailed approach to analyzing USB drive letter and volume name mappings in Windows systems provides forensic analysts with the capability to trace device connections and interactions, aiding in the reconstruction of digital events.