Key Identification

Key Insights

Artifact Locations

• USBSTOR: SYSTEM\CurrentControlSet\Enum\USBSTOR

• USB: SYSTEM\CurrentControlSet\Enum\USB

• SCSI: SYSTEM\CurrentControlSet\Enum\SCSI

• HID: SYSTEM\CurrentControlSet\Enum\HID

• Device Migration for Older Data: SYSTEM\Setup\Upgrade\PnP\CurrentControlSet\Control\DeviceMigration

Critical Information

• These Registry keys can help identify the vendor, product, and version of USB devices.

• The keys record the first and last connection times of a device.

• Devices lacking a unique internal serial number feature an "&" as the second character of the serial number.

• The displayed internal serial number might not match the physical serial number on the device.

• The ParentIdPrefix value under USB keys is crucial for linking a USB device entry to its corresponding SCSI entry.

• SCSI<ParentIdPrefix>\Device Parameters\Partmgr\DiskId correlates with Partition/Diagnostic logs and the Windows Portable Devices key for comprehensive device tracking.

• Data retention varies by Windows version, with Windows 10/11 retaining up to one year of data.

Overview

These Registry keys provide a wealth of information about each USB device that has been connected to the system:

• USBSTOR and USB keys are directly related to the identification of USB storage devices, including details such as device type, manufacturer, and model.

• SCSI keys often relate to storage devices that use SCSI command sets, which can include USB storage devices presented to the system using SCSI standards.

• HID (Human Interface Device) keys track peripherals such as keyboards, mice, and other devices that interact with the user interface.

Each key houses subkeys and values detailing the specifics of connected devices, including hardware IDs, vendor information, and connection timestamps. These details are pivotal in constructing a timeline of device usage, identifying suspicious activity, and corroborating other forensic findings.

Analyzing The Artifact

1. Identifying Connected USB Devices: Navigate to SYSTEM\CurrentControlSet\Enum\USBSTOR and SYSTEM\CurrentControlSet\Enum\USB to find entries for every USB device. Look for DeviceDesc values to identify device types and manufacturers.

2. Determining Connection Times: Examine the Properties subkey under each device entry for timestamp values. These can include installation and last removal times, which are essential for timeline analysis.

3. Serial Number Analysis: Serial numbers are located within the device's subkey name or under the Properties subkey. Analyze the format for unique identification or signs of generic serial numbers (e.g., those with an "&" symbol).

4. Linking USB to SCSI Entries: Use the ParentIdPrefix value found in USB device entries to link to corresponding SCSI device entries. This linkage is vital for understanding device interactions with the system at a lower level.

5. Reviewing HID Devices: For peripherals, explore the SYSTEM\CurrentControlSet\Enum\HID key. This can reveal information about non-storage USB devices connected to the system.

6. Historical Data Analysis: For systems upgraded from older versions of Windows, check SYSTEM\Setup\Upgrade\PnP\CurrentControlSet\Control\DeviceMigration for legacy device connection data.

Tools for Analysis

• RegRipper: Automates the extraction of forensic information from the Registry, including USB device connection histories.

• USBDeview: A utility that lists all USB devices that currently connected to your computer, as well as all USB devices that you previously used.

• Windows Registry Editor: Manual examination of the Registry can be conducted using the built-in Registry Editor (regedit), though this requires careful navigation and understanding of Registry structures.

Practical Use Case

In a scenario where an organization suspects data exfiltration via USB devices, forensic analysts can use the outlined Registry keys to identify all USB storage devices connected to a suspect machine. By analyzing connection times, device identifiers, and serial numbers, analysts can correlate device usage with other forensic artifacts (e.g., file access logs, shadow copies) to identify suspicious data transfers or unauthorized access.

USB device tracking through Windows Registry analysis offers a powerful method for understanding device interactions with a system, providing critical insights in forensic investigations and incident response activities.