Notifications
Clear all
Topic starter
04/09/2008 11:46 pm
Does anyone have a methodology for determining when entries were made in the Mounteddevices subkey?
Essentially, I would like to know which order the entries were made - but I would settle for knowing definitively the last entry made.
edit fixed thread title.
05/09/2008 11:34 pm
There may be a couple of ways of going about this…
If the system is XP, compare the current the System hive file to those located in Restore Points.
You might be able to find the MountedDevices key (no guarantee) in the unallocated space of the hive file itself…though that might be something of a stretch.
Another approach would be to correlate the entries with other artifacts, such as in the DeviceClasses subkey, or the MountPoints2 entries in the user's NTUSER.DAT file.
HTH,