Hey all,
Been working on a case where the requirement was so that we needed to ascertain when a device was first / last introduced to a system. Downloaded a great document from here that helped me find the keys under \Current Controlset\Enum\USBStor. Got all the info I needed, one of the entries is puzzling me..
The device - a USB hard drive shows as first introduced on 10/11/2006. The key that is created with the device serial number (boy, my description are bad!!) is showing that the was last introduced on 09/12/2006. The problem I have is that this device couldn't have been plugged in on 09/12/2006 as the laptop had been handed back to the employer. It is highly likely that the employer powered up the laptop on this date, but how do you explain this? I've tried testing to see if hibernation causes this to happen but no joy.
Any ideas greatfully received.