USBSTOR and USB Device Keys
Every USB storage device seen, with make, model, serial and connection times.
Use it to identify each USB stick by make, model and serial, with its first and last connection and removal times.
- SYSTEM
- USB Devices
What It Is
When a USB storage device is plugged in, Windows records it under these keys so it can load the right driver next time. That record names each device by make, model and serial number, and keeps the times it was first installed, last connected and last removed. The main keys are Enum\USBSTOR for storage and Enum\USB for the device itself, both in the SYSTEM hive.
What It Proves
A device with that serial was connected. Its Properties times give first connected (0064), last connected (0066) and last removed (0067), in UTC.
What It Does Not Prove
Major Windows updates clear these keys, so the history may start at the last upgrade. A driver update moves the 0064 time, while 0065 keeps the first install. A device with no serial of its own is given one by Windows, marked by an & as its second character.
Where It Lives
USBSTOR and USB Device Keys lives in the SYSTEM hive, which holds settings for the whole machine. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.
SYSTEM\C:\What It Looks Like
These are four values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.
| Registry Value | What It Tells You |
|---|---|
| A SanDisk Ultra stick, serial 4C530001230619115412 |
| First connected 2 Oct 2026 08:14 UTC. A driver update can move this time, so compare it with 0065, which keeps the first install. |
| Last connected 15 Oct 2026 16:28 UTC. MountPoints2 shows which user was logged on at that moment. |
| Last removed 15 Oct 2026 17:05 UTC, 37 minutes after it connected. Check what was opened or saved on the drive it held in that window. |
How to Read It
Under Enum\USB\VID_xxxx&PID_yyyy\<serial>, the Service value gives the class, such as USBSTOR, UASPStor or WUDFWpdMtp. Find the same serial under Enum\USBSTOR for the FriendlyName, while UASP disks sit under Enum\SCSI instead. Open the Properties subkey {83da6326-97a6-4088-9453-a1923f573b29}, where 0064 is first connected, 0066 last connected and 0067 last removed.
- When Windows Writes It
- When a device is first installed, and at each connection and removal.
- Which Windows Versions
- Windows 7 to 11 keep it. The 0066 and 0067 values, last connected and last removed, need Windows 8 or later.
- Tools That Parse It
- Registry Explorer, USB Detective, RECmd
Hunt It
The live tools that record device events catch each mount as it happens, within the time they keep, while the older devices sit only in the hive. Event 6416 in the Security log names the device by its identifiers, and Windows writes it only when Audit PNP Activity is on.
Records each mount as it happens, inside retention. It does not read USBSTOR, so older devices only show in the hive.
// USB drives mounted on the device, with make, model and serialDeviceEvents| where Timestamp > ago(Confirm It With
One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what USBSTOR and USB Device Keys shows.
- MountedDevicesNames the drive letter and volume GUID the stick had, which tie it to a user through MountPoints2.
- First Install in setupapi.dev.logNot in the RegistryRecords the device's first install in a text log, a check on 0064 and 0065 after a driver update.
- Partition/Diagnostic Event 1006Not in the RegistryLogs every connection with the device's serial, beyond the first and last kept here.
Sources
The facts on this page come from these public pages, which say more on each point.