USB Event Log Traces

The Windows registry tells you that a device was connected - the event logs tell you exactly when, for how long and what the OS did with it. Across seven distinct log channels, Windows records the complete connection lifecycle of a USB or external storage device: from the first kernel-level hardware detection through to driver unloading on disconnection. No single log tells the whole story. Cross-correlating all of them produces the most precise and tamper-resistant connection timeline available on any Windows endpoint.

Kernel-PnP / Device-Configuration

The kernel Plug and Play manager fires these events before any driver or user-mode process is aware the device exists. The timestamps here are the most authoritative connection anchors in the entire event log stack.

Earliest timestamp of physical connection. The DeviceInstanceID embeds the Vendor ID, Product ID and serial number - identical to the USBSTOR registry subkey name.

Confirms the device is active on the system bus and a driver has been assigned. Immediately precedes keystroke injection on HID attack devices and filesystem access on mass storage.

Partition / Diagnostic

The partition manager reads the raw partition table of every newly attached disk below the filesystem layer. The geometry data captured here reflects the physical layout of the drive and cannot be faked via software.

Primary device fingerprinting event. Sector count and per-partition offsets can uniquely identify a specific physical drive. Hidden partitions are visible here even if they do not appear in Explorer.

StorageVolume / Operational

Captures the precise moment the volume manager acknowledges a storage device and assigns it a Volume Unique ID (VUID). The VUID links this log directly to the HKLM\SYSTEM\MountedDevices registry key.

The definitive "drive became accessible" timestamp. Directly correlates to a MountedDevices registry entry via the VUID.

Written on clean removal. Absence of Event 2 following Event 1 for the same VUID indicates the drive was abruptly pulled.

DriverFrameworks-UserMode / Operational

When enabled, this is the most forensically complete USB connection log available. Vendor ID, Product ID and serial number appear inline in the event text - no registry lookup required. Also covers MTP devices invisible to USBSTOR.

Primary connection event. Hardware identifiers are embedded directly in the event - no secondary correlation needed. Timestamp marks the start of the connection window.

Marks the start of the sandboxed UMDF driver host session for the device.

Power state transition for the device. Correlate with system sleep/wake events to narrow the window during which a drive was accessible.

Driver host process exited - the disconnection timestamp. Paired with Event 2003 to define the complete connection window.

System.evtx

Does not record USB connection events directly, but captures the service-layer side-effects. Malicious USB-triggered payloads installed as services leave clear traces here.

Tracks the start and stop of services tied to the device. USBSTOR-related services starting immediately after physical connection corroborate the Kernel-PnP timeline.

A new service was installed. If a BadUSB attack or malicious driver drops a service payload, this fires. An ImagePath pointing to a temp or user-writable directory is a red flag.

Security.evtx

Does not record device connection directly. When object access auditing is configured, it is the only log that can prove which specific files were accessed on the USB volume.

A process opened a handle to a file on the device. ProcessName distinguishes user-initiated access from automated indexing or backup tools.

Every read or write attempt against a file on the USB volume. The highest-confidence evidence for data exfiltration - proves which files were touched, by whom and when.

WPD-MTPClassDriver / Operational

Smartphones and digital cameras connected over MTP never appear as USBSTOR devices. This log is the only structured event source for those connections - essential in any phone-based exfiltration investigation.

MTP device connected. Primary smartphone connection event - the human-readable device name and serial are recorded directly, absent from all USBSTOR registry paths.

MTP device disconnected. Combined with Event 1000 this defines the exact window during which the phone or camera was accessible for file transfer.

DeviceSetupManager / Operational

Records automatic driver discovery for new devices - including the hardware ID used to search Windows Update or the local driver store. Provides an additional first-connection timestamp for devices triggering a fresh driver install.

Windows began searching for a driver for a newly attached device. Fires only on first connection or when the existing driver is missing - provides an additional earliest-connection anchor.

A driver package was applied to the device. An unexpected DriverStorePath - such as a user-writable or temp directory - suggests a custom or malicious driver was delivered via the device itself.

Forensic Value

• Build a millisecond-precision connection timeline: Chain events from USB PnP and Kernel PnP to produce a complete, multi-source timeline from physical insertion through to disconnection.
• Prove data exfiltration with file-level detail: If object access auditing is active, Security Event 4663 records the exact filename and user identity for every file touched on the USB volume.
• Identify devices that left no registry trace: A sophisticated attacker may clear USBSTOR entries. Kernel-level events are not affected by registry cleanup and preserve the connection record independently.
• Detect abrupt removal mid-exfiltration: A StorageVolume Event 1 with no corresponding Event 2 indicates the drive was pulled without ejecting, consistent with someone interrupted mid-transfer.

For more Info check out these Articles: USB PnP, Kernel PnP