.. / Unique USB (User)

Star

• External Device/USB Usage

Description

• Find User that used the Unique USB Device.

  Location

  * Look for GUID from SYSTEM\MountedDevices
  * NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2
  

Interpretation

This GUID will be used next to identify the user that plugged in the device. The last write time of this key also corresponds to the last time the device was plugged into the machine by that user. The number will be referenced in the user’s personal mountpoints key in the NTUSER.DAT Hive