@jmundy: sure, unless it's not some noname pendrive, each vendor has a very precise lot numbering, production date, unique identifiers, etc., and the life of the pendrive can be traced from the factory to the first end-user. The real question is if a vendor answers you at all and would they trace it for you ?! Depends who is asking, but generally it's a ...NO! Good luck there 🙂
Although this might not assist I have often wondered if a USB serial number was known could it be used to trace where it was purchased from?
No.
The "world records of authorized USB sticks owners" I jokingly referred to does not exist and with the possible exception of SANDISK (which is different from most other manufacturers) what passcodeunlock stated is more wishful thinking that anything else.
The actual production of "common" USB sticks is roughly as follows (monoliths are slightly different as they have no case):
1) the actual stick (PCB and components soldered to it) is produced in large, large numbers
2) the case, plastic or plastic+metal is produced
3) the stick is put into the case and (usually) sealed in it (ultrasonic plastic welding)
4) the stick is manually connected to a PC and setup (groups of 8/10/12 sticks are connected to PC's with the same number of USB ports) with the "manufacturer's tools", which usually do some 4 things:
5a. memory chip type, size etc. settings are written to the device
5b. memory is actually tested (maybe)
5c.type of device (removable, fixed, partitioned, etc.) is written to device and one or more filesystems
5d.the serial number is written to the device
6) a device found working/passing the tests is packaged in a single blister or similar
7) a shipping box is filled with these blisters/single packages
8) shipping boxes are stacked
9) some of these boxes (at random) are taken from the stack and sent to a wholesaler/distributor
10) the whoilesaler/distributor open these boxes, randomly takes out of them a given number of packages and sends them to the shop
11) the shop takes a single item from these smaller box and sells it to you
3) and 4) may be done in reverse order, and as well sub-points in #5 may be done in a different order)
Any of the macro-steps above from 1) to 9) may take place in a same factory or in several diffrent factories.
Up to steps 5 the actual stick has no serial anyway.
Steps 5 are performed "in parallel", i.e. there are tens of PC's (and people) processing the sticks at the same time, and besides my personal doubt that the serial numbers are coorrdinated and synced among these several workstations (so it is IMHO entirely possible that a serial is duplicated) it has to be seen if the serial is added before or after the "quality" test (if it is done before, some serials simply won't exist, so the serials won't be really sequential).
Anyway even IF serials were sequential, there is nothing on the physical stick or in the single (blister) packaging about it, and even IF from the factory a box of - say - 1000 pieces actually ships containing stick with serials 00000001 to 00001000 (which as said it is not given) there are steps 10) and 11) that will mix up things.
jaclaz
Although this might not assist I have often wondered if a USB serial number was known could it be used to trace where it was purchased from?
No.
The "world records of authorized USB sticks owners" I jokingly referred to does not exist and with the possible exception of SANDISK (which is different from most other manufacturers) what passcodeunlock stated is more wishful thinking that anything else.
The actual production of "common" USB sticks is roughly as follows (monoliths are slightly different as they have no case):
1) the actual stick (PCB and components soldered to it) is produced in large, large numbers
2) the case, plastic or plastic+metal is produced
3) the stick is put into the case and (usually) sealed in it (ultrasonic plastic welding)
4) the stick is manually connected to a PC and setup (groups of 8/10/12 sticks are connected to PC's with the same number of USB ports) with the "manufacturer's tools", which usually do some 4 things:
5a. memory chip type, size etc. settings are written to the device
5b. memory is actually tested (maybe)
5c.type of device (removable, fixed, partitioned, etc.) is written to device and one or more filesystems
5d.the serial number is written to the device
6) a device found working/passing the tests is packaged in a single blister or similar
7) a shipping box is filled with these blisters/single packages
8) shipping boxes are stacked
9) some of these boxes (at random) are taken from the stack and sent to a wholesaler/distributor
10) the whoilesaler/distributor open these boxes, randomly takes out of them a given number of packages and sends them to the shop
11) the shop takes a single item from these smaller box and sells it to you3) and 4) may be done in reverse order, and as well sub-points in #5 may be done in a different order)
Any of the macro-steps above from 1) to 9) may take place in a same factory or in several diffrent factories.
Up to steps 5 the actual stick has no serial anyway.
Steps 5 are performed "in parallel", i.e. there are tens of PC's (and people) processing the sticks at the same time, and besides my personal doubt that the serial numbers are coorrdinated and synced among these several workstations (so it is IMHO entirely possible that a serial is duplicated) it has to be seen if the serial is added before or after the "quality" test (if it is done before, some serials simply won't exist, so the serials won't be really sequential).Anyway even IF serials were sequential, there is nothing on the physical stick or in the single (blister) packaging about it, and even IF from the factory a box of - say - 1000 pieces actually ships containing stick with serials 00000001 to 00001000 (which as said it is not given) there are steps 10) and 11) that will mix up things.
jaclaz
What's the point of a serial number then?
What's the point of a serial number then?
The serial number is an identifier hopefully "unique" (as said it is not necessarily "unique" in an absolute sense, but when combined to device ID - Vid & Pid - it is quite frankly very, very unlike that a collision happens), useful (and used) by the Windows MountManager and other parts of Windows.
But - as another example - they can be a form of authentication/validation, there are programs that are installed (and validated) with a connection to the specific USB stick (i.e. the program won't run on a "normal" clone of the stick),
Unless you use the suitable "manufacturer tool" the serial cannot be changed with any "normal" tool, so if you find "physically" a USB stick, check its Vid&Pid, serial and it is (say) Vid_0951&Pid_1665 and AC220B280A431051E97C05E1, and you examine a Windows PC and usbdeview (or similar, anyway artifacts in the Registry, like USB\Vid_0951&Pid_1665\AC220B280A431051E97C05E1) tells you that last Plug/Unplug date for that serial is (still say) 02/08/2018 11.53.59, it is reasonable to state that that particular stick has been last connected on that particular date/time.
jaclaz
