MountedDevices registry key

HKLM\System\MountedDevices

The MountedDevices subkey stores the database of mounted devices for the NTFS filesystem
https://technet.microsoft.com/en-us/library/cc978525.aspx

mounteddevices_20170404221711d0e.png

USBドライブならHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR\配下のレジストリにデバイス情報があります。

参考
http://www.forensicswiki.org/wiki/USB_History_Viewing
https://www.forensicmag.com/article/2012/08/windows-7-registry-forensics-part-6

Leave a Reply

Your email address will not be published. Required fields are marked *