Windows Portable Devices
The volume label of each USB stick, and the name of each phone or camera connected.
Use it to get the volume label of a USB stick, or the name of a phone, to match against LNK files and Jump Lists.
- SOFTWARE
- USB Devices
What It Is
Windows Portable Devices is where Windows records the portable devices it has set up, such as USB sticks, phones and cameras, with a friendly name for each. From it you get the volume label of a USB stick, or the name of a phone, to match against LNK files and Jump Lists. It also lists phones and cameras that never get a drive letter. It keeps only the last label. It lives in SOFTWARE.
What It Proves
A device with that ID and serial was connected, and FriendlyName gives its last volume label or, for a phone, its name. It also lists phones and cameras that never get a drive letter.
What It Does Not Prove
Only the last label is kept, and a volume with no label shows its drive letter instead. Feature updates often reset the subkey last write times, so treat them as weak dates.
Where It Lives
Windows Portable Devices lives in the SOFTWARE hive, which holds settings for the whole machine. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.
SOFTWARE\C:\What It Looks Like
These are three values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.
| Registry Value | What It Tells You |
|---|---|
| The serial in this name matches the SanDisk stick in USBSTOR, so both describe one device. Its FriendlyName gives the volume label, CLIENTS. |
| The stick's volume was last labelled CLIENTS. Search LNK files and Jump Lists for that label to find files opened from it. |
| An Apple iPhone, named by its model, with no drive letter or USBSTOR entry. Its connection times are in Enum\ |
How to Read It
Subkey names hold the device ID with # in place of the backslash, followed by a class GUID, so match the serial inside the name to USBSTOR. FriendlyName gives the last volume label of a stick, or for a phone the name it reports, such as Apple iPhone. The VID and PID in the subkey name lead back to Enum\USB.
- When Windows Writes It
- When a device is set up as a portable device, and when its label changes.
- Which Windows Versions
- Windows 7 to 11
- Tools That Parse It
- Registry Explorer, USB Detective, RECmd
Hunt It
The label and device name sit in this key, so parse SOFTWARE, or read it live with Velociraptor. Event 6416 in the Security log shows a device connecting, and Windows writes it only when Audit PNP Activity is on.
Shows portable devices as they connect, inside retention. It does not read the key, so take the volume label from FriendlyName.
// Portable devices (class WPD) connected: phones, cameras and USB volumesDeviceEvents| where Timestamp > ago(Confirm It With
One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what Windows Portable Devices shows.
- USBSTOR and USB Device KeysGives first and last connection times, where these subkey times are weak.
- Volume Label in LNK Files and Jump ListsNot in the RegistryShows files opened from a volume with this label, so the stick was used, not just plugged in.
- Partition/Diagnostic Event 1006Not in the RegistryLogs each connection with the device's serial, which dates it better than these keys.
Sources
The facts on this page come from these public pages, which say more on each point.