So I have an issue. I have a MicroSD MC that I need to tie to a machine. The issue is, I have two possible machines that have card readers on them, of the SD form factor.
The MicroSD card came in an MicroSD-to-SD adapter. When using a card reader or write-blocker, I can only get information about the reader and/or write-blocker.
Does anyone know of a of or IF it is possible to determine what machine the MicroSD card was last attached to?
It's probable that you already know/have done this. Just in case
If the reader was connected via USB port, you might be able to find evidence of the presence of the card within the registry of one or both of the machines.
Check SYSTEM\CurrentControlSet\Enum\USBSTOR for Mfg Co., Model Name, Serial #, and version of USB devices that were attached to the system; see if the card appears there. Check the SETUPAPI.LOG, too, for first connection time.
You'll not likely find any data on the card itself that records machine connects. However, artifacts on the card and one or both of the machines, when placed in context and compared, might confirm or strongly suggest that the card had been present at one time. For example, check machine LNK files and timestamps against files found on the SD card. Search the pagefiles for unique artifacts found on the SD card.
There's no harm in contacting the manufacturer to research the possibility that the card might have internal code that could yield evidence of connection.
Good luck to you!
When a USB removable storage device is connected to a Windows system for the first time, the Plug and Play Manager receives the event notification, queries the device descriptor for the appropriate information to develop a device class ID and attempts to locate the appropriate driver for that device. Looking for and installing the correct driver for the device is recorded in the setupapi.log file. This provides the date and time that the removable storage device was first connected to the system. The Windows system will also create an entry in the Registry beneath the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR\ key using the device class ID.
Beneath this Registry key, a unique instance ID key will be created, using either the serial number retrieved from the device's device descriptor (UVCView can be used to view the contents of the device descriptor), or, if the device does not have a serial number, using an identifier generated by the system itself.
In order to determine the last time the device was connected to the system, we have to navigate to
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceClasses
The bold portion of the key name is the devices unique instance ID, which in this case, is also the device's serial number. Similarly, the Volume GUID key contains subkeys for each volume that was mounted on the system, and those subkey names appear as follows
##?#STORAGE#RemovableMedia#7&2c9a320d&0&RM#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
I did some testing a while ago. I found, on my machine at least, that memory cards did not leave the expected traces in the registry. Instead, when a memory card was plugged in, the recorded information was that of the memory card reader (such as serial number) instead of that of the card.
I wouldn't let you change your analysis; however, if you see things that aren't making sense, this might be it. I think, overall, link files might be your best bet. All you need is the volume serial number from the memory card.