Detect if a Flash Drive Was Used

There are two methods which can be used in order to determine whether or not a flash drive has been used with the Windows operating system. This night's tip will show how to perform the first method when working with Windows 7.

Method One

1. Go to Start and enter 'Run'

2. Enter 'regedit'

3. Registry Editor will open. In the folder tree on the left look under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR

. . . if you go through the data listed in the pane to the right for the various subfolders, in a DeviceDesc field you should see a reference to something like 'USB DISK 2.0', or at least the phrase 'disk drive' used in a longer description. The FriendlyName field may include a reference to the brand name of the flash drive.

If Windows had trouble recognizing the drive, there should be a reference to it in a different Registry Editor folder, HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\WpdBusEnumRoot\UMB\

These references will remain after the flash drive is removed and the system is restarted. This is a good little forensics trick to determine how likely it is that someone has been trying to copy data off a laptop and how often.

Tomorrow night a second method . . .