USBSTOR missing in Registry

Have you looked through prefetch files to see if any possible cleaning tools were used?

I have analyzed the windows system registry file and cannot locate the USBSTOR folder under Controlset\Enum\.

What particular version and release of Windows is this?

The following details on the OS.

OS Windows xp with service pack 3
Current Version. 5.1

I havent conducted much analysis on the prefetch files. i have over 1000 of them. is there a specific one that i can look at?

There is an anti-forensics article on this topic.

http//www.anti-forensics.com/delete-usb-device-history-from-the-windows-registry-usbstor-key-and-the-setupapilog

There is an anti-forensics article on this topic.

http//www.anti-forensics.com/delete-usb-device-history-from-the-windows-registry-usbstor-key-and-the-setupapilog

Linky no worky

Linky no worky

Go for waybackmachine . archive .org , and search for the link.

Link works now, hosting bill wasn't paid.

I have received a computer to conduct forensic analysis on to see if any USB devices have been plugged into the computer. I have analyzed the windows system registry file and cannot locate the USBSTOR folder under Controlset\Enum\.

Did you happen to run regslack to see if the keys had been deleted?

Have you checked any of the other keys associated with USB device analysis, specifically the DeviceClasses subkeys? MountedDevices values?

I have also looked for setupapi.dev.log file and cannot locate it under the Windows\inf directory.

As this is an XP system, you're not interested in a file named "setupapi.dev.log"…that's the log file used by Windows 7; for XP, you're interested in setupapi.log. If you haven't found either, have you found any indications of the file having been deleted, such as fragments located in unallocated space?

Lastly i checked the recent folder, this is also clean.

…

I have not located any system cleaners as yet.

Have you checked the UserAssist subkeys? MUICache values?

I think at one point in the thread, you'd mentioned having about 1000 Prefetch files; have you found any that may be associated with tools such as CCleaner, Window Washer, etc?