A Windows forensics investigator wants to determine which USB storage devices have been connected to a system. Which Registry key contains this information?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because the USBSTOR registry key records each unique USB storage device that has been connected, including device type, vendor ID, product ID, and serial number, making it the primary forensic artifact for USB device history. A is wrong because the LSA key stores security policy settings and cached domain credentials, not USB device history.
Full explanation below image
Full Explanation
B is correct because the USBSTOR registry key records each unique USB storage device that has been connected, including device type, vendor ID, product ID, and serial number, making it the primary forensic artifact for USB device history. A is wrong because the LSA key stores security policy settings and cached domain credentials, not USB device history. C is wrong because the Run key stores startup programs, not device connection history. D is wrong because ProfileList maps user SIDs to profile paths, not USB device history.