USB 사용 기록 조사

Event viewer -> system32 log (%SystemRoot%\inf\Setupapi.dev.log) -> registry

순으로 확인한다. 이벤트 뷰어랑 log는 기록이 누락되어 있는 경우가 잦다. 레지스트리를 직접 보려면 레지스트리 분석 도구를 이용해야 하기 때문에 어차피 도구를 이용할 거라면 USBDeview를 이용해서 보는 편이 낫다.

USB Device Tracking Artifacts on Windows 7, 8(RP)

 Vendor & Product Name, Version
HKLM\SYSTEM\ControlSet00#\Enum\USBSTOR\Disk&Ven_{Vendor Name}&Prod_{Product Name}&Rev_{Version}

 Vendor ID, Product ID
HKLM\SYSTEM\ControlSet00#\Enum\USB\VID_{Vendor ID}&PID_{Product ID}

 Serial Number
HKLM\SYSTEM\ControlSet00#\Enum\USB\{Vendor ID & Product ID}\{Serial Number}
HKLM\SYSTEM\ControlSet00#\Enum\USBSTOR\{Device Class ID}\{Serial Number}&# 

 Volume Serial Number
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\EMDMgmt\_??_USBSTOR#{Device Class ID}#{Unique Instance ID}#{GUID}{Volume Label}_{Volume Serial Number} 

 Volume Label
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\EMDMgmt\_??_USBSTOR#{Device Class ID}#{Unique Instance ID}#{GUID}{Volume Label}_{Volume Serial Number}
HKLM\SOFTWARE\Microsoft\Windows Portable Devices\Devices\{Device Entry}\FriendlyName (value) 
HKLM\System\ControlSet00#\Enum\WpdBusEnumRoot\UMB\{Device Entry}\FriendlyName (value) 

 Drive Letter
HKLM\System\MountedDevices (search for serial number)
HKLM\SOFTWARE\Microsoft\Windows Portable Devices\Devices\{Device Entry}\FriendlyName (value)
HKLM\System\ControlSet00#\Enum\WpdBusEnumRoot\UMB\{Device Entry}\FriendlyName (value)

 Volume GUID
HKLM\SYSTEM\MountedDevices\\??\Volume{Volume GUID} (search for serial number)

 User Name
HKU\{USER}\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{Volume GUID}

 First Connection Time (Last Written Time in registry key)
HKLM\SYSTEM\ControlSet00#\Control\DeviceClasses\{10497B1B-BA51-44E5-8318-A65C837B6661}\{Sub Keys} 
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\EMDMgmt\{Device Entry} 
HKLM\SOFTWARE\Microsoft\Windows Portable Devices\Devices\{Device Entry} 

 First Connection Time After Booting (Last Written Time in registry key)
HKLM\SYSTEM\ControlSet00#\Control\DeviceClasses\{53F56307-B6BF-11D0-94F2-00A0C91EFB8B}\{Sub Keys} 
HKLM\SYSTEM\ControlSet00#\Control\DeviceClasses\{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}\{Sub Keys} 
HKLM\SYSTEM\ControlSet00#\Control\DeviceClasses\{6AC27878-A6FA-4155-BA85-F98F491D4F33}\{Sub Keys} 
HKLM\SYSTEM\ControlSet00#\Control\DeviceClasses\{A5DCBF10-6530-11D2-901F-00C04FB951ED}\{Sub Keys} 
HKLM\SYSTEM\ControlSet00#\Enum\WpdBusEnumRoot\UMB\{Device Entry}

 Last Connection Time (Last Written Time in registry key)
HKLM\SYSTEM\ControlSet00#\Enum\WpdBusEnumRoot\UMB\{Device Entry}\Device Parameters 
HKU\{USER}\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{Volume GUID}