Episode
Course 36 - Windows Forensics and Tools | Episode 13: Decoding Registry Artifacts and Connection History
- Podcast
- CyberCode Academy
- Published
- Jun 11, 2026
- Duration seconds
- 770
- Processing state
not_requested
Actions
POST https://stenobird.com/v1/public/podcasts/cybercode-academy-7578615/episodes/course-36-windows-forensics-and-tools-episode-13-decoding-registry-artifacts-and-connection-history/transcription-requests
Idempotently request low-priority transcript generation for this episode.GET https://stenobird.com/podcast/cybercode-academy-7578615/course-36-windows-forensics-and-tools-episode-13-decoding-registry-artifacts-and-connection-history.md
Read the agent-friendly Markdown representation of this episode resource.
Summary
In this lesson, you’ll learn about: Windows USB forensics and how external device activity is tracked through the Windows Registry1. What Is Windows USB Forensics?USB forensics focuses on identifying and analyzing traces left by: USB flash drives External hard drives Digital cameras and mobile storage devices 🔹 Key Idea Even after a device is unplugged or removed, Windows keeps permanent evidence of its connection.2. Why USB Devices Leave Forensic EvidenceWhen a USB device is connected, Windows automatically: Logs device identity Stores serial numbers Records connection history Links devices to specific users 🔹 Forensic Value This allows investigators to reconstruct: Who used the device When it was connected What machine it was connected to 3. USBSTOR Registry Key (Device Identity Tracking)🔹 What it is A registry location that stores details of USB storage devices🔹 What it records Vendor name (e.g., SanDisk, Kingston) Product model Unique serial number 👉 Key Insight This is the digital fingerprint of every USB device ever connected4. MountedDevices Key (Drive Letter Mapping)🔹 What it is Links physical USB devices to assigned drive letters (E:, F:, etc.)🔹 What it reveals Which USB got which drive letter How Windows mapped the storage at connection time 👉 Key Insight Helps reconstruct how the system interacted with external storage5. MountPoints2 Key (User-Level Evidence)🔹 What it is Stores per-user information about mounted devices🔹 What it reveals Which user connected the device Access history from user profile perspective 👉 Key Insight Connects USB activity directly to a specific Windows user account6. Forensic Significance of USB Artifacts🔹 What investigators can determine: First time a device was plugged in Last time it was used Frequency of usage Possible data tran…