USB Device List (Enum\USB)
Every USB device seen, of any kind, by vendor ID, product ID and serial number.
Use it to identify the USB devices that were connected, of any kind, by vendor, product and serial number.
- SYSTEM
- USB Devices
What It Is
Under Enum\USB in the SYSTEM hive, Windows records every USB device it has seen, of any kind, by vendor ID, product ID and serial number. It is the first stop when profiling any USB device, because its Service value says whether the device was storage, a phone, a keyboard or a camera. The storage keys under USBSTOR build on this. The identifiers can be claimed rather than proven.
What It Proves
A device with that vendor ID, product ID and serial was connected, and the Service value says what kind, whether storage, a phone, a keyboard or a camera. It is the first stop when profiling any USB device.
What It Does Not Prove
Vendor and product IDs can be spoofed, so they name a claimed maker. A serial with & as its second character was made up by Windows and is not unique, and feature updates can clear the key.
Where It Lives
USB Device List (Enum\USB) lives in the SYSTEM hive, which holds settings for the whole machine. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.
SYSTEM\C:\What It Looks Like
These are four values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.
| Registry Value | What It Tells You |
|---|---|
| The SanDisk Ultra stick, serial 4C530001230619115412, is USB storage (USBSTOR). Follow the serial to USBSTOR and MountedDevices for its drive letter. |
| An Apple iPhone, a composite device whose phone part gets no drive letter. Look for it in Windows Portable Devices, not USBSTOR. |
| A Logitech mouse with no serial: |
| Under the SanDisk serial, 0064 dates its first connection to 2 Oct 2026 08:14 UTC. USBSTOR has the same time, so the two keys agree. |
How to Read It
Look up the VID and PID in a USB ID list, where VID_0781 is SanDisk, for example. The subkey under VID and PID is the serial, iSerialNumber, and an & as its second character means Windows made it up. The Service value gives the class, such as USBSTOR or UASPStor for storage, WUDFWpdMtp for phones and HidUsb for keyboards and mice, while usbccgp marks a composite device whose functions sit under &MI_ keys. The Properties subkey {83da6326-97a6-4088-9453-a1923f573b29} holds 0064, 0066 and 0067, as under USBSTOR.
- When Windows Writes It
- When a USB device is first installed, and at each connection and removal.
- Which Windows Versions
- Windows XP to 11 keep it. The Properties times appear from Windows 7, and 0066 and 0067 from Windows 8.
- Tools That Parse It
- Registry Explorer, USB Detective, RECmd
Hunt It
The device history sits in this key, while live mounts appear in the device events EDR records. Event 6416 in the Security log names each device, and Windows writes it only when Audit PNP Activity is on.
Records connections of every device class within retention. DeviceId carries the VID, PID and serial, while the key keeps devices from before.
// Plug and play devices connected, any class, with the device IDDeviceEvents| where Timestamp > ago(Confirm It With
One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what USB Device List (Enum\USB) shows.
- USBSTOR and USB Device KeysAdds make, model and connection times for storage devices.
- Windows Portable DevicesGives the volume label or phone name, to match against files opened from it.
- New Device Recognised, Security Event 6416Not in the RegistryLogs each new device with its IDs and time, if Plug and Play auditing is on.
Sources
The facts on this page come from these public pages, which say more on each point.