CHFI OS and Network Forensics Practice Question
A forensic analyst is investigating a Windows system for evidence of USB device usage. Which registry key is MOST useful for determining the first time a USB device was connected and its serial number?
⚠ Common exam trap
EC-Council often tests whether candidates confuse the generic USB hub enumeration key (USB) with the mass storage device-specific key (USBSTOR), leading them to pick Option D instead of A.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR
The USBSTOR key under HKLM\SYSTEM\CurrentControlSet\Enum stores a subkey for each USB mass storage device that has ever been connected to the system. Each subkey is named with the device's serial number, and its creation timestamp reflects the first time the device was enumerated (i.e., first connected). This makes it the definitive source for both the serial number and the initial connection time of a USB device.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR
Why this is correct
This is the authoritative artifact for USB mass storage device forensics. Each time a USB drive or external storage device is attached, Windows enumerates it under HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR, creating a subkey whose name contains the device instance ID, vendor, product, revision, and often the unique serial number. The LastWrite time of these subkeys reflects when the device was installed/configured, enabling an examiner to reconstruct a timeline of device connections and identify the specific physical drive by its serial number.
- ✗
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2
Why it's wrong here
MountPoints2 tracks the drive-letter and volume mount-point mappings made by each user, storing subkeys for volumes with names like '{GUID}' or drive letters such as 'E:\'. While it can show which volume was mapped to which letter and when the mapping was last accessed, it does not store the device's USB serial number or its internal registry device instance ID. Therefore it is a supporting artifact for establishing user awareness of a volume, but it is insufficient alone to positively identify a USB storage device.
- ✗
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellBags
Why it's wrong here
ShellBags does not contain USB device or serial number data; it records user-specific Explorer window settings such as folder view mode, icon size, and window position for each folder the user has opened. Its forensic value lies in revealing that a user browsed a particular folder path—possibly on an external drive—and the timestamps associated with those browsing activities. However, it cannot prove when a USB device was plugged in, what its serial number was, or whether it was ever formally installed by the operating system.
- ✗
HKLM\SYSTEM\CurrentControlSet\Enum\USB
Why it's wrong here
This key enumerates the broad USB device tree—host controllers, root hubs, and individual USB function devices such as keyboards, mice, and generic USB peripherals—under identifiers like VID/PID and hub port numbers. Unlike USBSTOR, which is specifically for USB mass-storage class devices, this branch does not consistently record the unique serial numbers of connected drives or provide the same connection-install timeline for storage devices. An examiner looking for USB drive history should look to USBSTOR rather than this generic USB enumeration key.
Go deeper
Related to this question
About these practice questions
One of 205 original CHFI practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.