New
#11
How to delete the USB storage history
-
-
New #12
I only want to know the working principle of USBDeview, how it uninstall the USB drivers? why i can not delete the sub key located on "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR" in Windows 7 OS? Do not ask why please, because i only want to study computer knowledge! Thank you.
-
-
New #14
I know how to get all the installed usb devices from Registry
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR
but how to get the created date and last plug/unplug date of usb devices like USBDeview
View any installed/connected USB device on your system
Thank you
-
New #15
the reason why
Folks did you know that if you plug a USB drive into your PC at work the ID of that drive is recorded and your employer, or ex employer may demand that you produce said drive to him before you leave the company (or even after you leave) I can 100% that this is true as I have spent the last 7 months in legal battles over a $10 item with court costs running close to $100000 all because I can not produce this drive. Obviously there is a reason they want the drive related to IP and confidential info but bottom line is; I dont have it they want it and can show it was in my machine.
So either clean the drive to make sure they never see it was in there or keep it to hand in, at the least offer it on leaving.
-
New #16
Hi yxq,
An easy way to do it is to use the drivecleanup tool from Drive Tools for Windows
Have a look at my post here .
-
New #17
https://code.google.com/p/usboblivion/
Not sure if the OP wants this - have not tried it.
-
New #18
^ That seems to be an interesting application. Downloads - usboblivion - An utility designed to erase all traces of USB drives from Windows registry - Google Project Hosting
"USBOblivion is a small (portable) utility that will erase all traces of USB-connected storage devices (including iPods) and CD-ROMs from the Windows registry. The registry data stores details including drive manufacturer, last connected date various other details which will be completely removed after running USBOblivion. By default, the program starts in a simulation mode, allowing you to preview the results of the cleaning. If you want to proceed, you can run the process again, this time checking the "Real clean" option.USBOblivion also comes with an option to create a registry backup file of the removed entries, so that in case you run into problems, you can undo the cleaning operation. The app will only remove entries for Mass Storage devices, it will not interfere with your USB mouse, keyboard, wireless adapters etc."
After doing a drivecleanup, which is my favourite tool, I ran USB oblivion in the simulation mode.
Oops.... it showed a few hundred registry entries pertaining to almost all the USB devices I had used, atleast the names like Transcend jetflash, HP v220w etc.,
A screenshot:
On the face of it, it does seem to do a thorough forensic cleaning that will suit those who are likely to be liable to corporate espionage investigations rightly or wrongly - as faced by mate chirpychippy.
For ordinary users though who want to avoid USB problems, the drive cleanup tool should be sufficient. Extreme scrubbing and registry manipulation - that can create problems (and that is why USB Oblivion provides a backup option, just in case ) may not be neceaasry.
That said, nice catch @pincushion.Last edited by jumanji; 06 Sep 2012 at 02:59.
-
New #19
In my more paranoid moments I seem to download lots of useful little apps after following links but usually don't end up using them. I think the forensics people would still be able to recover data unless further measures were taken since this stuff is probably just deleted from the registry and probably recoverable however.
:)
-
New #20
Recovering the deleted registry entries is definitely possible (with the software like YARU Yet Another Registry Utility ) but as with any recovery, the success depends upon how fast one acts to recover. With hours and days passing with the computer being used, these can easily be overwritten and recovery may be impossible.
Quote
Related Discussions