tag:blogger.com,1999:blog-9518042.post9195726998611433788..comments2024-03-19T07:46:20.437-05:00Comments on Windows Incident Response: Portable Devices on VistaUnknownnoreply@blogger.comBlogger4125tag:blogger.com,1999:blog-9518042.post-15435726309018676612019-04-24T04:05:48.548-05:002019-04-24T04:05:48.548-05:00Great Work! Thank u for wonderful information.Great Work! Thank u for wonderful information.shikharhttp://portablegeneratorguide.net/best-portable-diesel-generator/noreply@blogger.comtag:blogger.com,1999:blog-9518042.post-67524434243942394582008-06-14T16:45:00.000-05:002008-06-14T16:45:00.000-05:00Jimmy,In the XP registry, a U-3 leaves two keys......Jimmy,<BR/><BR/><I>In the XP registry, a U-3 leaves two keys...</I><BR/><BR/>Yes, this was documented in my book.<BR/><BR/><I>Several exist for the same type of device...</I><BR/><BR/>I noticed that, too. I also noticed that each of the keys had a different LastWrite time, as well.<BR/><BR/><I>The distinction is important...</I><BR/><BR/>Agreed, but in the excerpt I displayed in my blog post, there had been no U3 devices plugged into that system...the GeekSquad device you see was plugged in after I had removed the U3 components.H. Carveyhttps://www.blogger.com/profile/08966595734678290320noreply@blogger.comtag:blogger.com,1999:blog-9518042.post-60273350050868333722008-06-14T15:32:00.000-05:002008-06-14T15:32:00.000-05:00In the XP registry, a U-3 leaves two keys in HKLM\...In the XP registry, a U-3 leaves two keys in HKLM\SYSTEM\ControlSet001\Enum\USBSTOR. One is for the "CD," and the other is for the disk drive. (I think that I sent you an XP System hive with U-3 entries.) However, in taking a quick look at a Vista registry while writing, it seems that there are far more entries under the Portable Devices key than in USBSTOR. Several exist for the same type of device, e.g., a Sony DSC, which strikes me as odd. Could be worth a study. Want a couple keys? :-)<BR/><BR/>In the display that you presented, I think that the Geeksquad entry refers to the disk drive and not to the CD. The distinction is important, and perhaps the cited Vista key does not list the virtual CD associated with U-3s.Anonymousnoreply@blogger.comtag:blogger.com,1999:blog-9518042.post-43097380091262541352008-06-11T17:58:00.000-05:002008-06-11T17:58:00.000-05:00Thats good!Thats good!Jason Koppehttps://www.blogger.com/profile/10649074891135062829noreply@blogger.com