Notifications
Clear all

USBSTOR Analysis  

  RSS
iDan
 iDan
(@idan)
New Member

Hi guys. Wondering if anyone could clear up a question of mind regarding USBSTOR in the windows registry.

This is a screenshot of a computers registry files regarding USB devices that have been connected. My question is about the two highlighted values. Are they the serial IDs of different USB devices, or values created when the same device has been connected on multiple occasions.

Should be a very quick answer for your guys,

Thanks in advance,
Dan

Quote
Posted : 14/05/2013 2:00 am
keydet89
(@keydet89)
Community Legend

This is a screenshot of a computers registry files regarding USB devices that have been connected.

To be correct, they're USB _storage_ devices that have been connected.

My question is about the two highlighted values. Are they the serial IDs of different USB devices, or values created when the same device has been connected on multiple occasions.

Hardware-based serial numbers from the firmware of the devices.

ReplyQuote
Posted : 14/05/2013 4:11 am
sward6
(@sward6)
New Member

This is a screenshot of a computers registry files regarding USB devices that have been connected.

To be correct, they're USB _storage_ devices that have been connected.

My question is about the two highlighted values. Are they the serial IDs of different USB devices, or values created when the same device has been connected on multiple occasions.

Hardware-based serial numbers from the firmware of the devices.

And just to use this as a learning point for myself, the way I would read that, is it being two separate usb storage devices (with two different serial numbers) of the same make/model. Am I correct assuming this?

ReplyQuote
Posted : 14/05/2013 9:45 am
jaclaz
(@jaclaz)
Community Legend

And just to use this as a learning point for myself, the way I would read that, is it being two separate usb storage devices (with two different serial numbers) of the same make/model. Am I correct assuming this?

Yes, but no (to be picky). 😯

It may be the same device been connected twice, one before and one after the serial change (there are "Manufacturer Production Tools" around that can do that).

For some sticks there are also "recovery" tools from the Manufacturer, to be used if the device fails or becomes "read only" or gets in a "0 byte size" assertion, I never noticed/took note if using any of them the serial was changed or remained the same.
Usually on "Manufacturer Production Tool" there is a setting like

  • auto-number
  • set number
  • keep current number

and the recovery tools which are often "stripped down" versions of the MTP may have the first option set.

As well, though unlikely and irrelevant, it could be once (or twice) a "real" Kingston Data Traveler SE9 and once (or twice) a "fake" one.

jaclaz

ReplyQuote
Posted : 14/05/2013 5:48 pm
sward6
(@sward6)
New Member

And just to use this as a learning point for myself, the way I would read that, is it being two separate usb storage devices (with two different serial numbers) of the same make/model. Am I correct assuming this?

Yes, but no (to be picky). 😯

It may be the same device been connected twice, one before and one after the serial change (there are "Manufacturer Production Tools" around that can do that).

For some sticks there are also "recovery" tools from the Manufacturer, to be used if the device fails or becomes "read only" or gets in a "0 byte size" assertion, I never noticed/took note if using any of them the serial was changed or remained the same.
Usually on "Manufacturer Production Tool" there is a setting like

  • auto-number
  • set number
  • keep current number

and the recovery tools which are often "stripped down" versions of the MTP may have the first option set.

As well, though unlikely and irrelevant, it could be once (or twice) a "real" Kingston Data Traveler SE9 and once (or twice) a "fake" one.

jaclaz

Thanks for the explanation!

ReplyQuote
Posted : 14/05/2013 11:49 pm
Share: