GCFA Windows Artifact Analysis Practice Question
A forensic analyst is examining a Windows 10 system and wants to determine which USB storage devices have been connected to the machine. The analyst has access to the registry. Which registry key should the analyst examine to find a list of USB devices that have been connected, including vendor and product IDs?
⚠ Common exam trap
Many candidates confuse the general USB enumeration key with the USBSTOR key, which is specifically for mass storage devices and contains the vendor and product details.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR
The USBSTOR registry key under HKLM\SYSTEM\CurrentControlSet\Enum is the authoritative location for USB mass storage device connection history. It records the vendor, product, and revision of each device, along with a serial number when available. Other USB-related keys either include non-storage devices or lack the detailed storage-specific information needed to identify connected USB drives.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
HKLM\SOFTWARE\Microsoft\Windows Portable Devices\Devices
Why it's wrong here
This key stores information about portable devices such as media players and phones that use the Windows Portable Devices (WPD) API. It does not comprehensively track USB mass storage devices, and many USB flash drives do not appear here. It is not the correct artifact for USB storage connection history.
- ✗
HKLM\SYSTEM\CurrentControlSet\Enum\USB
Why it's wrong here
The USB key under Enum contains information about USB devices in general, including non-storage devices like keyboards and mice. While it may list some storage devices, it is not specific to USB mass storage and does not provide the same level of detail for storage device identification as the USBSTOR key.
- ✓
HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR
Why this is correct
The USBSTOR key under Enum stores information about USB mass storage devices that have been connected to the system. Each subkey corresponds to a device and includes the vendor, product, and revision, as well as a serial number if available. This is the primary artifact for determining USB storage device connection history.
- ✗
HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR\Enum
Why it's wrong here
This key under the USBSTOR service stores a list of device instance IDs for USB storage devices, but it is not the primary location for vendor and product information. The Enum\USBSTOR key under CurrentControlSet is the correct location for that data. This key may be used for correlation but is not the main source.
About these practice questions
Courseiva writes every GCFA question from scratch — 292 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official GIAC exam blueprint
This GCFA practice question is part of Courseiva's free GIAC certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the GCFA exam.