Help on Registry Key

[vince123123]

I heard from a source that there are keys in Windows XP Registry which track the plugging in and unplugging in of external storage devices (e.g. thumb drives, memory card readers, disk drives etc) and when these were plugged or unplugged.

Anyone has any idea which key tracks this stuffs?

Thanks!

 

[dolpjki]

i'm not too sure abt which key the registry reads from for plugin devices but i know there's this directory that will show all drives available:
HKEY_LOCAL_MACHINE\SYSTEM\MountedDevices

this will display a new drive key when u plug in a memory card reader /w card.

 

[vince123123]

Does this key show a log on past drives that were plugged in and out from the PC? Or does it only show whats' plugged in at that point in time.

Thanks for your response!

i'm not too sure abt which key the registry reads from for plugin devices but i know there's this directory that will show all drives available:
HKEY_LOCAL_MACHINE\SYSTEM\MountedDevices

this will display a new drive key when u plug in a memory card reader /w card.

 

[dolpjki]

this key will only show wht's plugged in at the point of time. it does not show any log. u can test it out by goin to that directory, then plug in ur memory card reader /w card, then refresh to see the new key entry.

wht do u actually need?

 

[vince123123]

I need the log to check back what had happened in the past - what external storage devices were plugge in and when they were plugged in. I heard that a Registry Key stores this information.

this key will only show wht's plugged in at the point of time. it does not show any log. u can test it out by goin to that directory, then plug in ur memory card reader /w card, then refresh to see the new key entry.

wht do u actually need?

 

[dolpjki]

well.. i tried looking thru the registry, this might look like what u were asking for:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum

at least, i can see the past VGA card i had used for my system when i look under the different keys at HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\PCI

 

[vince123123]

From your advice, I think this is the one:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\USBSTOR

Thanks for your update - although I'm not quite sure how to read it, but its a start. If you have any more information, I'd be grateful.

well.. i tried looking thru the registry, this might look like what u were asking for:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum

at least, i can see the past VGA card i had used for my system when i look under the different keys at HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\PCI

 

[dolpjki]

for example, under HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\USB
u should see value pairs of Vidxxx&Pidxxx, expand any one of it, there would be at least one more key under it (e.g. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\USB\Vid_0a16&Pid_9780\5&29c7aec0&0&2)

u would be able to see "DeviceDesc". hope this helps
im also learning while i'm looking through the registry. so should i provide the wrong info, juz update me.