How to Find USB Memory History

Sometimes, it can be useful to know how and by whom devices such as usb and flash memory are connected to the computer when we are not present. In addition, we will discuss this subject in this study, which can be used as a resource for those who want to specialize in forensic medicine and criminal investigation.

How Does It Work?

We all know how Windows keeps logs. In the application called "registry" in Windows, it continuously records all hardware devices, software programs and user preference settings of the computer.

When a USB stick is inserted into the computer, the computer creates a registry with the name "usbstore".

This registry stores all kinds of information about the files in the USB. All kinds of information that the operating system needs to know in USB can be obtained from this registry.

How to Find USB Attachment History

If we want to find the additional history of the USB device, we must follow these steps in order.

1. Enter "regedit" in the run system.

2. Enter the file named "Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\usbstor" in the registry we mentioned.

Then you will find a file named "USBSTOR" there.

3. After entering the "USBSTOR" registration notification here, you will see a list of all files connected to your computer from the USB device you have examined.

When we come to this recording unit, we see that many USB devices have been connected to the computer before.

However, let's move on to the next step to understand which model devices they are;

4. Select any device from this list and click the subkey on the right. You will then see an entry with the name "Friendlygame". Right in front of this entry, you can see what type of device the USB device is.

5. Finding the USB registration number

If we want to find the USB registration number, we enter the Windows "run" system in the same way and write "cmd".

Then we write "wmic diskdrive get Model, InterfaceType, SerialNumber" respectively on the black screen that appears.

And we have reached the interface type, models and serial numbers of the USB sticks connected to our computer.

Yes, you can now find the models, serial numbers and files of the USBs plugged into the computer.