CHFI OS and File System Forensics Practice Question
A forensic investigator is examining a Windows 10 workstation that was seized after a suspected data exfiltration. The user claims they only used legitimate cloud storage. The investigator wants to determine which USB mass storage devices were previously connected to the system by examining the Windows registry. Which registry location should the investigator examine to find the device instance IDs and associated volume serial numbers of previously connected USB storage devices?
⚠ Common exam trap
Watch out — candidates often confuse MountPoints2 with USBSTOR, as both can show USB usage but only USBSTOR stores the device instance IDs and serial numbers needed for definitive identification.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR
The USBSTOR registry key under the SYSTEM hive is specifically designed to track USB mass storage devices. It records device instance IDs, which include the vendor ID, product ID, and serial number, allowing investigators to identify unique devices. This key persists even after the device is removed, making it a reliable source for determining previous USB storage connections.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR
Why this is correct
The USBSTOR key under the SYSTEM hive stores information about USB mass storage devices that have been connected. Each subkey represents a device instance and contains details such as the device serial number, friendly name, and sometimes the volume serial number. This is the primary location for tracing USB storage device history on Windows systems.
- ✗
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs
Why it's wrong here
RecentDocs records recently opened documents and files by the user, not USB device connections. It provides evidence of user activity with files but does not contain any information about USB mass storage devices or their serial numbers. Therefore, it is irrelevant for determining which USB devices were connected.
- ✗
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2
Why it's wrong here
MountPoints2 tracks mounted volumes and network shares per user, including drive letters and mount points, but it does not store detailed USB device instance information like serial numbers. While it can show that a volume was mounted, it lacks the device-specific data needed to identify the USB storage device itself, making it less useful for this purpose.
- ✗
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\USBHUB\Enum
Why it's wrong here
The USBHUB Enum key may list USB hubs and some connected devices, but it is not the authoritative location for USB mass storage device history. It often lacks the persistent device instance IDs and volume serial numbers that are crucial for forensic identification of specific USB storage devices, making it a less reliable source than USBSTOR.
Go deeper
Related to this question
About these practice questions
This CHFI question is part of Courseiva's 745-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official EC-Council exam blueprint
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.