Notifications
Clear all

USBSTOR Analysis

5 Posts
4 Users
0 Reactions
2,394 Views
 iDan
(@idan)
Active Member
Joined: 14 years ago
Posts: 8
Topic starter  

Hi guys. Wondering if anyone could clear up a question of mind regarding USBSTOR in the windows registry.

This is a screenshot of a computers registry files regarding USB devices that have been connected. My question is about the two highlighted values. Are they the serial IDs of different USB devices, or values created when the same device has been connected on multiple occasions.

Should be a very quick answer for your guys,

Thanks in advance,
Dan


   
Quote
keydet89
(@keydet89)
Famed Member
Joined: 21 years ago
Posts: 3568
 

This is a screenshot of a computers registry files regarding USB devices that have been connected.

To be correct, they're USB _storage_ devices that have been connected.

My question is about the two highlighted values. Are they the serial IDs of different USB devices, or values created when the same device has been connected on multiple occasions.

Hardware-based serial numbers from the firmware of the devices.


   
ReplyQuote
sward6
(@sward6)
Eminent Member
Joined: 13 years ago
Posts: 23
 

This is a screenshot of a computers registry files regarding USB devices that have been connected.

To be correct, they're USB _storage_ devices that have been connected.

My question is about the two highlighted values. Are they the serial IDs of different USB devices, or values created when the same device has been connected on multiple occasions.

Hardware-based serial numbers from the firmware of the devices.

And just to use this as a learning point for myself, the way I would read that, is it being two separate usb storage devices (with two different serial numbers) of the same make/model. Am I correct assuming this?


   
ReplyQuote
jaclaz
(@jaclaz)
Illustrious Member
Joined: 18 years ago
Posts: 5133
 

And just to use this as a learning point for myself, the way I would read that, is it being two separate usb storage devices (with two different serial numbers) of the same make/model. Am I correct assuming this?

Yes, but no (to be picky). 😯

It may be the same device been connected twice, one before and one after the serial change (there are "Manufacturer Production Tools" around that can do that).

For some sticks there are also "recovery" tools from the Manufacturer, to be used if the device fails or becomes "read only" or gets in a "0 byte size" assertion, I never noticed/took note if using any of them the serial was changed or remained the same.
Usually on "Manufacturer Production Tool" there is a setting like

  • auto-number
  • set number
  • keep current number

and the recovery tools which are often "stripped down" versions of the MTP may have the first option set.

As well, though unlikely and irrelevant, it could be once (or twice) a "real" Kingston Data Traveler SE9 and once (or twice) a "fake" one.

jaclaz


   
ReplyQuote
sward6
(@sward6)
Eminent Member
Joined: 13 years ago
Posts: 23
 

And just to use this as a learning point for myself, the way I would read that, is it being two separate usb storage devices (with two different serial numbers) of the same make/model. Am I correct assuming this?

Yes, but no (to be picky). 😯

It may be the same device been connected twice, one before and one after the serial change (there are "Manufacturer Production Tools" around that can do that).

For some sticks there are also "recovery" tools from the Manufacturer, to be used if the device fails or becomes "read only" or gets in a "0 byte size" assertion, I never noticed/took note if using any of them the serial was changed or remained the same.
Usually on "Manufacturer Production Tool" there is a setting like

  • auto-number
  • set number
  • keep current number

and the recovery tools which are often "stripped down" versions of the MTP may have the first option set.

As well, though unlikely and irrelevant, it could be once (or twice) a "real" Kingston Data Traveler SE9 and once (or twice) a "fake" one.

jaclaz

Thanks for the explanation!


   
ReplyQuote
Share: