three windows artifacts that prove a USB was plugged in

windows never forgets a usb stick

"i never plugged anything in" is one of those lines that sounds convincing right up until someone runs three quick registry queries. windows is a hoarder. it keeps records of nearly every removable device that's ever touched a port, and those records don't just show up once, they show up in three separate places that all have to agree with each other. if you're doing incident response, auditing a shared machine, or just trying to figure out what happened to your own computer, this is the trifecta you check.

artifact one: usbstor

this is the master list. every usb storage device that's ever been connected to that windows install gets a permanent entry here, complete with vendor, product name, and serial number.

reg query HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR /s

breaking it down: reg query reads registry keys from the command line, HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR is the specific hive path where windows logs usb mass storage devices, and /s tells it to recurse into every subkey so you get the full device tree instead of just the top level. what you get back is a serial number tied to a specific physical stick. that serial is the anchor for everything else in this post.

artifact two: setupapi.dev.log

usbstor tells you a device exists in windows' memory. setupapi.dev.log tells you exactly when windows first met it, down to the millisecond, because it's a plain text install log that records every device installation event on the system.

findstr /i "<serial>" C:\Windows\INF\setupapi.dev.log

findstr is windows' built in text search, /i makes it case insensitive so formatting differences don't cause a miss, and you swap in the actual serial number you pulled from usbstor. this gives you a timestamp for first connection, which is gold if you're trying to build a timeline instead of just proving "yes, at some point."

artifact three: portable devices

this key covers media transfer protocol devices, phones, cameras, some tablets, and it stores something the other two don't always give you cleanly: the actual volume label the user set on the device. "PHOTOS_BACKUP" or "MY_STUFF" shows up right there.

reg query "HKLM\SOFTWARE\Microsoft\Windows Portable Devices\Devices" /s

same structure as before, just a different hive path, and the quotes are there because the path has spaces in it. this is the corroborating detail that turns "a device with this serial was connected" into "the device labeled X was connected," which matters when you're trying to match evidence to a specific physical item sitting on someone's desk.

why three artifacts instead of one

any single artifact can be explained away or, in rare cases, tampered with or incomplete. three independent artifacts that all point to the same serial number, timestamp, and label are a lot harder to argue with. that's the whole point of corroboration in forensics, you're not trusting one log, you're checking whether multiple unrelated logging mechanisms tell the same story.

the takeaway

if you manage machines, especially in a small business or a household with shared computers, these three checks take about two minutes and tell you the real usb history of a system, no special tools required. use them to audit machines before you hand them off, to investigate a suspicious device connection, or honestly just to know what's been plugged into your own laptop over the years. if you want to actually reduce your exposure instead of just detecting after the fact, disable usb storage via group policy on machines that don't need it, enable removable storage access logging in your event viewer settings, and physically cover or disable unused ports on anything sensitive. the goal isn't to catch people lying, it's to make sure your own systems can't be quietly used as a dead drop without you knowing about it.