Registry Files

I often reformat and reinstall and have never seen residual registry artifacts from the previous installation. I can't speak to using "repair" or such techniques however.

If the hard drive was formated using a Windows XP disk and then reinstalled, would the registry files that are currently active on the machine contain information of USB devices attached to the computer prior to the format.

No.

Also I was looking in FTK's Registry Vewier and It says to go to Enum/USBSTOR. I only see USB.

Misprint? HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR

I am supposed to export the system file found within windows/system32/config. The file structure as I see it is ControlSet001, ControlSet002, Mounted Devices, Select, Setup. If i go into services under ControlSet I still do not see USBSTOR

If i go into services under ControlSet I still do not see USBSTOR

Have you considered the possibility that no USB devices were connected after the re-install?

Have you checked the other ControlSets?

I'm more interested in finding if before the re-installation if there were USB devices installed, and yes I did check the other Control Sets.

I don't think previous usb devices will show up if the os is reinstalled..

I could be wrong though..

-Derrick

If the hard drive was formated using a Windows XP disk and then reinstalled, would the registry files that are currently active on the machine contain information of USB devices attached to the computer prior to the format.

Thinking through this logically, I'm not sure I understand why you think it would.

Look at it this way…what happened when you formatted the disk using the XP disk? For the purposes of the OS, all of the previous files were gone. Gone. No more. So when the new copy of XP was installed, there were freshly created Registry files, in their default format.

Given this, why would one even consider the USB devices connected to the system *before* the reinstall would appear in the Registry of the fresh install?

I'm not trying to belittle anyone, just trying to see the reasoning behind the question, that's all. I provide training, so it helps me to understand the reasoning that others may have when developing training, or even writing an article or book…

Harlan

I am supposed to export the system file found within windows/system32/config. The file structure as I see it is ControlSet001, ControlSet002, Mounted Devices, Select, Setup. If i go into services under ControlSet I still do not see USBSTOR

That's because it's not under the Services key.

Try opening RegEdit on your system…under System, you'll see the ControlSets, and under each of those, you'll see Enum. Just like you mentioned in your first post, USBStor will be located under Enum, not under Services.

HTH,

Harlan

Little background on me. I'm a computer science student looking to get into this field. So I am working part time just trying to learn the ropes before I graduate.