CHFI (312-49) Digital Forensics Simulation

Investigation Scenario

A biomedical research facility in San Diego, California, suspects a terminated employee of stealing proprietary formulation data. Network forensics confirmed no unauthorized outbound transmissions. However, physical access logs indicate the subject accessed their workstation off-hours prior to termination.

A forensic investigator arrives on-site and acquires a bit-stream physical image (E01) of the subject's Windows 10 workstation. The investigator hypothesizes that data was exfiltrated via removable media and begins analyzing the extracted registry hives to prove a USB mass storage device was connected to the system.

Evidence Collected

Question

In a digital-forensics investigation in San Diego, California, an analyst is searching for evidence of data exfiltration via a USB flash drive. Which Windows Registry key should the analyst examine to identify the USB devices that have been connected to the system?

Expert Analysis

1. What the Evidence Shows

To prove exfiltration, we must establish that a specific physical device was introduced to the environment. The SYSTEM registry hive acts as the authoritative record of hardware configuration. Locating the serial number maps the digital footprint directly to physical evidence (the suspect's flash drive).

2. Identify Forensic Stage

Examination and Analysis. The investigator has already collected the E01 image and extracted the hives. They are now actively examining the data structures to extract relevant artifacts and analyzing their meaning.

3. Why the Correct Answer is Correct

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR is the Windows Plug and Play (PnP) subsystem's registry path for enumerating USB Mass Storage devices. When a USB drive is inserted, Windows creates a subkey here format as: Disk&Ven_[Vendor]&Prod_[Product]&Rev_[Revision]. Inside this subkey resides another key named with the device's Serial Number (or a generated instance ID if a unique serial isn't available, indicated by a leading &).

4. Why Others Are Wrong

• MountPoints2: Tracks connected volumes per user (NTUSER.DAT), good for proving which user interacted with the drive, but not the definitive hardware list.
• Winlogon: Controls authentication UI and session management.
• Memory Management: Controls RAM and Pagefile settings (e.g., ClearPageFileAtShutdown).

5. Real-World Forensic Action

As an investigator, you would export the SYSTEM hive, load it into a tool like Registry Explorer or RegRipper, and extract the USBSTOR entries. You would then correlate the extracted Serial Number against the setupapi.dev.log to determine the exact timestamp of the first insertion, and check SYSTEM\CurrentControlSet\Enum\USB to find the timestamp of the last connection.