UASP Disks (Enum\SCSI)
Fast USB 3 disks that use UASP, which skip USBSTOR and appear under Enum\SCSI.
Use it to find fast USB 3 disks that skip USBSTOR, with their connection times, through Enum\SCSI.
- SYSTEM
- USB Devices
What It Is
Fast USB 3 disks that use the UASP protocol are handled as SCSI devices, so they skip USBSTOR and appear under Enum\SCSI instead. This is where to find them, with the connection times in their Properties key, which USBSTOR would otherwise hold. Internal disks sit under Enum\SCSI too, so each entry has to be tied back to a USB device. It lives in the SYSTEM hive.
What It Proves
A UASP disk of that make and model was connected, with first connected, last connected and last removed times in its Properties key. ParentIdPrefix ties it back to its serial in Enum\USB.
What It Does Not Prove
Internal disks sit under Enum\SCSI too, so keep only entries you can tie to Enum\USB. UASP disks do not appear to get a volume GUID in MountPoints2, so link them to a user through logons or LNK files.
Where It Lives
UASP Disks (Enum\SCSI) lives in the SYSTEM hive, which holds settings for the whole machine. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.
SYSTEM\C:\What It Looks Like
These are four values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.
| Registry Value | What It Tells You |
|---|---|
| A Samsung T5 SSD on UASP, serial S49WNP0M902147T once the MSFT30 prefix is dropped. UASP disks skip USBSTOR, so profile it under Enum\ |
| ParentIdPrefix 8 |
| Under Enum\ |
| The T5 was last connected 13 Oct 2026 19:22 UTC. MountPoints2 may not name its user, so check event 4624 in the Security log for who was logged on then. |
How to Read It
In Enum\USB, find the device whose Service is UASPStor, and note its ParentIdPrefix and its serial, dropping the MSFT30 prefix. Under Enum\SCSI, the subkey named with that ParentIdPrefix is the same disk. Read FriendlyName there, then the Properties subkey {83da6326-97a6-4088-9453-a1923f573b29} for 0064, 0066 and 0067, the first connected, last connected and last removed times.
- When Windows Writes It
- When the disk is first installed, and at each connection and removal.
- Which Windows Versions
- Windows 8 to 11, which support UASP natively
- Tools That Parse It
- Registry Explorer, USB Detective, RECmd
Hunt It
The device history sits in this key, while a live mount appears in the device events EDR records. Event 6416 in the Security log names the disk, and Windows writes it only when Audit PNP Activity is on.
Internal disks rarely reconnect, so a new SCSI disk here is usually external. It does not read the registry keys.
// SCSI disk devices connected: how UASP disks appearDeviceEvents| where Timestamp > ago(Confirm It With
One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what UASP Disks (Enum\SCSI) shows.
- USB Device List (Enum\USB)Ties the disk to its USB serial through ParentIdPrefix, which sets it apart from internal disks.
- VolumeInfoCacheGives the label of the volume at its drive letter, which covers UASP disks.
- Partition/Diagnostic Event 1006Not in the RegistryLogs each connection with the disk's serial, a check on its times.
Sources
The facts on this page come from these public pages, which say more on each point.