Device Migration (Last
Devices Windows carried through a feature update, with the date each was last present.
Use it to recover USB devices a feature update wiped from USBSTOR, with the date Windows last saw each one.
- SYSTEM
- USB Devices
What It Is
When Windows runs a feature update it carries its device database across, and it records the devices it migrated with the date each was last present. This record recovers USB devices a feature update wiped from USBSTOR, with the date Windows last saw each one. It keeps a last present date only, and only for the latest update. It lives in the SYSTEM hive.
What It Proves
A device with that ID and serial was connected before the update. LastPresentDate gives the last time Windows saw it, even when the update cleared its USBSTOR history.
What It Does Not Prove
It keeps a last present date only, not first or last connection times. It covers the latest update, so for older ones read the hives in Windows.old or a shadow copy.
Where It Lives
Device Migration (LastPresentDate) lives in the SYSTEM hive, which holds settings for the whole machine. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.
SYSTEM\C:\What It Looks Like
These are three values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.
| Registry Value | What It Tells You |
|---|---|
| A Kingston stick was seen before the 3 Sep 2026 update, which cleared it from USBSTOR. Search every hive for its serial for any other trace. |
| Windows last saw the Kingston stick 28 Aug 2026 17:40 UTC, six days before the update. Check LNK files for files opened from it before then. |
| The same serial appears under its vendor and product IDs, where VID_ |
How to Read It
Under Devices, look for subkeys named like Enum entries, such as USBSTOR, USB, SWD\WPDBUSENUM and SCSI device IDs with their serials. LastPresentDate is a FILETIME in UTC, the last time Windows saw that device before the update. Also check SYSTEM\ControlSet001\Control\DeviceMigration, which holds less detail.
- When Windows Writes It
- During a feature update, when setup migrates the device database.
- Which Windows Versions
- Windows 10 and 11, after a feature update
- Tools That Parse It
- Registry Explorer, RECmd
Hunt It
What the update migrated sits in this key, so parse the SYSTEM hive, or read it live with Velociraptor. The USB keys hold the live history for devices seen since the update.
Defender has no record of it, and device events from before the update are usually past retention. Parse the SYSTEM hive.
Parse the Hive Instead
- Collect
C:\Windows\ System32\ config\ SYSTEM - Parse With
- Registry ExplorerRECmd
Confirm It With
One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what Device Migration (LastPresentDate) shows.
- USBSTOR and USB Device KeysGives first and last connection times for devices seen since the update.
- Feature Update History (Source OS)Gives the date of the feature update that carried these devices through.
- Windows.old Folder and Volume Shadow CopiesNot in the RegistryHolds the old hives, with USB history from before the update.
Sources
The facts on this page come from these public pages, which say more on each point.