0

I want to check what devices connected to my computer in last 30 days.
Is there any way to view history of connected USB devices (including volume name) in windows 7?

1 Answer 1

2

You are in to the area of Forensics, so that's what you should look for in Google. The problem with some of this is that it's not officially documented. However, any external device information, even if previously attached, will be recorded in certain registry keys. The trick is to find out which and in what format.

It's been a while but I remember starting with:

HKLM\System\MountedDevices

The format for each key is REG_BINARY but it's 16-bit text. There are GUIDs for each device that has been attached, the device’s name, and its serial number.

Without actually going off and doing it myself, I can give you some examples. Eg:

Name: \??\Volume{c861df80-1440-11e2-9288-d4bed9441b44}    REG_BINARY ...... {.. GUID...}

If I decode the data in REG_BINARY, I'd get a GUID that would cross reference to, say,

Name: “\DosDevices\E:”  REG_BINARY ..... (same GUID in here somewhere)

So you'd get the details and serial number from the first and see where it was connected in the second. The GUID can also be used to find the same USB device and its serial number in other Keys, specifically:

HKLM\SYSTEM\ControlSet001\Control\DeviceClasses\{GUID}

In brief, a few other keys of interest to you:

 HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2 

If a GUID from “HKLM\SYSTEM\MountedDevices” key matches a GUID in this key (for this user - it's HKCU, not HKLM), then indicates which user was logged in when that particular USB device was connected. The “Last Write Time” is in here somewhere too.

 HKLM\SYSTEM\CurrentControlSet\Control\DeviceClasses\ 

The subkeys here (GUID again) include the device name, its serial number, and other GUID Subkeys. A timeline for when each device was attached and then later removed is also captured.

I haven't delved into depth with actual examples as I'd need to decode the REG_BINARY but I can reedit this post and add detail if you wish. Note I was using REG QUERY to delve through this, but I've just noticed regedit will decode the detail for you if you double click on a key (don't edit it!!)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .