The short answer: USBSTOR registry entries persist indefinitely. setupapi.dev.log records first-connection timestamp plus driver install but rotates on size threshold. Windows Event Log captures connection plus disconnection with timestamps but rolls over per retention size. Together these three artifacts produce a forensic record of USB device activity that often survives years on an unmaintained system.
The USBSTOR Registry Key
The Windows registry key HKLM/SYSTEM/CurrentControlSet/Enum/USBSTOR is the primary forensic artifact for USB device connection history. The key is populated by the USB driver stack when a USB mass-storage class device is first connected. Each connected device produces a subkey containing the vendor identifier, product identifier, revision identifier plus device serial number. The serial number is the load-bearing field for forensic identification because it uniquely identifies the physical device even when the same model has been connected multiple times.
USBSTOR entries persist across reboots, user logons plus most cleanup utilities. They are not removed when the device is unplugged. Standard Windows disk cleanup, browser cache clearing plus user profile reset do not touch USBSTOR. The entries survive Windows update installs plus most operator-driven system maintenance. The artifact is one of the most durable forensic records on a Windows system.
The setupapi.dev.log File
The C:/Windows/INF/setupapi.dev.log file is a text log written by the Plug and Play subsystem when devices are connected plus drivers are installed. The log records the first-connection timestamp for each device, the driver package selected, the driver install outcome plus the device instance identifier. For USB mass-storage devices the log entry includes the USB vendor identifier plus product identifier plus enough device identification to correlate against the USBSTOR registry record.
The setupapi.dev.log file is the source of truth for first-connection timestamps. The USBSTOR registry records the fact of connection but does not record when the connection occurred. The setupapi.dev.log records the timestamp. The log rotates on size threshold (default approximately 100 MB) plus on size-bounded systems the oldest entries can be lost. For machines with heavy USB device variety (developer workstations, IT technician laptops) the log may only cover the last few months of activity. For machines with limited USB activity the log can preserve years of history.
Windows Event Log USB Activity
The Windows Event Log captures USB connection plus disconnection activity across several log channels. The Microsoft-Windows-DriverFrameworks-UserMode/Operational log records device installation events with timestamps. The System log records driver install plus configure events. The Security log captures user logon plus logoff events that correlate against USB device connection timestamps. The Microsoft-Windows-Partition/Diagnostic log captures partition-level events including USB storage device mount.
Event log retention is configured per log channel with default size limits. The default size limit for Operational logs is in the range of 1 to 20 MB which on a typical system covers anywhere from a few weeks to a few months of activity. Investigators triaging a Windows machine for USB device activity should preserve the relevant event log channels immediately because rollover continues during the investigation timeline if the system stays running.
User Attribution for Connection Events
The forensic question of which user was logged in at the time of a specific USB device connection is answered by correlating the USB connection timestamp against the Security event log session events. Event ID 4624 records successful logon with the user account name, the logon type plus the session identifier. Event ID 4634 records logoff. The session identifier connects logon plus logoff events into a continuous session.
The correlation procedure: identify the USB connection timestamp from setupapi.dev.log or the Operational driver log. Find the most recent prior 4624 event before that timestamp plus confirm there is no intervening 4634 closing that session. The user account from the 4624 event is the attributed user. For systems with fast user switching active or with multiple simultaneous sessions the correlation needs the session identifier from the 4624 event matched against the session identifier in the device event log entry.
Use Cases the Records Support
USB device connection records support several recurring forensic investigation use cases. Data exfiltration investigations need to identify whether a USB storage device was connected during the suspect window plus which user account had the device. IP theft investigations need to correlate USB device serial numbers across multiple machines to establish whether the same device was used to copy from one system plus paste to another. Departed employee investigations need to confirm whether the employee connected unauthorized USB devices in the weeks before separation. Workplace policy enforcement investigations need to identify whether prohibited device classes (personal storage, mobile devices, music players) were connected.
For organizations operating Sherlock USB Blocker for endpoint USB device control the same Windows artifact set serves as the audit trail for the USB Blocker enforcement decisions. The Sherlock USB Blocker Pro integrates with the standard Windows USB enumeration path which means USB Blocker policy decisions plus the underlying device events appear in the same artifact set. The Sherlock methodology pairs USB Blocker policy logs with the registry plus log artifacts to produce a complete record of attempted plus allowed device connections.
The Acquisition Discipline That Matters
For investigators arriving at a Windows machine where USB activity is in scope the acquisition discipline matters. First, preserve the registry hive (typically C:/Windows/System32/config/SYSTEM) plus the setupapi.dev.log plus the relevant event log channels before any analysis. Second, hash plus document chain of custody. Third, parse the artifacts with tooling that handles the current Windows version (RegRipper plugins by Harlan Carvey for registry parsing, the standard Windows wevtutil utility for event log export, simple text parsing for setupapi.dev.log).
The artifacts are durable but the acquisition still matters because subsequent system activity can overwrite log entries through normal operation. The first hour of investigation is the cleanest snapshot the examiner will get of the relevant artifact set. Subsequent days of normal system operation can erode the event log retention plus the setupapi.dev.log can rotate on size threshold under continued USB activity.
USB connection records are one of the most durable forensic artifact classes on Windows. They survive longer than browser history, longer than mail cache, longer than recent documents lists. For investigations where USB device activity is relevant the artifact set is the right starting point.