# Course 36 - Windows Forensics and Tools | Episode 13: Decoding Registry Artifacts and Connection History

Page: https://stenobird.com/podcast/cybercode-academy-7578615/course-36-windows-forensics-and-tools-episode-13-decoding-registry-artifacts-and-connection-history
Text version: https://stenobird.com/podcast/cybercode-academy-7578615/course-36-windows-forensics-and-tools-episode-13-decoding-registry-artifacts-and-connection-history.md
Podcast: [CyberCode Academy](https://stenobird.com/podcast/cybercode-academy-7578615)
Published: 2026-06-11T06:00:02+00:00
Episode link: https://www.spreaker.com/episode/course-36-windows-forensics-and-tools-episode-13-decoding-registry-artifacts-and-connection-history--72013803
Audio file: https://dts.podtrac.com/redirect.mp3/api.spreaker.com/download/episode/72013803/how_windows_records_every_external_device.mp3
Processing state: not_requested
JSON: https://stenobird.com/v1/public/podcasts/cybercode-academy-7578615/episodes/course-36-windows-forensics-and-tools-episode-13-decoding-registry-artifacts-and-connection-history
Duration seconds: 770

## Resource

In this lesson, you’ll learn about: Windows USB forensics and how external device activity is tracked through the Windows Registry1. What Is Windows USB Forensics?USB forensics focuses on identifying and analyzing traces left by: USB flash drives External hard drives Digital cameras and mobile storage devices 🔹 Key Idea Even after a device is unplugged or removed, Windows keeps permanent evidence of its connection.2. Why USB Devices Leave Forensic EvidenceWhen a USB device is connected, Windows automatically: Logs device identity Stores serial numbers Records connection history Links devices to specific users 🔹 Forensic Value This allows investigators to reconstruct: Who used the device When it was connected What machine it was connected to 3. USBSTOR Registry Key (Device Identity Tracking)🔹 What it is A registry location that stores details of USB storage devices🔹 What it records Vendor name (e.g., SanDisk, Kingston) Product model Unique serial number 👉 Key Insight This is the digital fingerprint of every USB device ever connected4. MountedDevices Key (Drive Letter Mapping)🔹 What it is Links physical USB devices to assigned drive letters (E:, F:, etc.)🔹 What it reveals Which USB got which drive letter How Windows mapped the storage at connection time 👉 Key Insight Helps reconstruct how the system interacted with external storage5. MountPoints2 Key (User-Level Evidence)🔹 What it is Stores per-user information about mounted devices🔹 What it reveals Which user connected the device Access history from user profile perspective 👉 Key Insight Connects USB activity directly to a specific Windows user account6. Forensic Significance of USB Artifacts🔹 What investigators can determine: First time a device was plugged in Last time it was used Frequency of usage Possible data tran…

## Actions

- request_transcript: `POST https://stenobird.com/v1/public/podcasts/cybercode-academy-7578615/episodes/course-36-windows-forensics-and-tools-episode-13-decoding-registry-artifacts-and-connection-history/transcription-requests` — Idempotently request low-priority transcript generation for this episode.
- read_markdown: `GET https://stenobird.com/podcast/cybercode-academy-7578615/course-36-windows-forensics-and-tools-episode-13-decoding-registry-artifacts-and-connection-history.md` — Read the agent-friendly Markdown representation of this episode resource.

A page view does not enqueue transcription. Agents should invoke `request_transcript` explicitly when they need this episode processed.

## Transcript

Full transcripts are not published on public pages unless there is a clear rights basis.