A question about arbitrary values in USB registry keys
Brief
I was recently teaching the SANS FOR500 Windows Forensic Analysis class in Canberra and I was asked a question about how we track the connection times for USB devices in the registry:
My answer at the time was, “they are arbitrary” but I thought I should look into it a little bit more, and I’m glad I did! This is also something that was kind of discussed a very long time ago , but I’d not really looked into it myself.
Digging in!
If you go into the Registry, under the USB registry key you can find a series of GUIDs and their subkeys contain hex characters:
Doing some searching for the GUID led me to an interesting file that I didn’t realise has been distributed in the Windows SDK. I’m also realising that I should look at the Windows SDK more often if I want to try figure out details about a thing.
Enter devpkey.h
There’s a file called devpkey.