Investigating USB Drive Usage

by Jul 19, 2012

With two lines of PowerShell code, you can dump the USB storage history from your registry and check which devices were used in the past:

PS> $key = 'Registry::HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR\*\*'
PS> Get-ItemProperty $key | Select-Object -ExpandProperty FriendlyName | Sort-Object
APPLE SD Card Reader USB Device
Flash Disk USB Device
Intenso Rainbow USB Device
iT1167 USB Flash Disk USB Device
Kingston DataTraveler 102 USB Device
Kingston DataTraveler 2.0 USB Device
Kingston DT R500 USB Device
PI-239 USB 2.0 Drive USB Device
SanDisk Cruzer USB Device
SanDisk Cruzer USB Device
SMI USB DISK USB Device
USB Flash Disk USB Device
Verbatim STORE N GO USB Device

Twitter This Tip! ReTweet this Tip!