CYBER FORENSICS - Windows Registry Forensics part 2 & part 3

PART 2:-

In part 2 of registry forensics I will be  showing you how to find details about attached usb storage devices in a windows system from the windows registry.

Follow the below mentioned steps to find details about the attached usb storage devices in a windows system :-

1)Open Windows Registry

2)Go to HKEY_LOCAL_MACHINE 

3)Go to SYSTEM

4)Go to ControlSet002

5)Go to Enum

6)Go to USBSTOR

Thats it !!!! :)

I have made the video of the whole process so that you understand better.

PART 3:-

 
In part 2 of registry forensics I will be  showing you how to find details about mounted devices in  a windows system from the windows registry.

Follow the below mentioned steps to find details about mounted devices in a windows system :-

1)Open Windows Registry

2)Go to HKEY_LOCAL_MACHINE

3)Go to SYSTEM

4)Go to CurrentControlSet

5)Go to MountedDevices

Thats it !!!! :)

I have made the video of the whole process so that you understand better. 

I will be posting more cool posts on windows registry forensics.
So stay tuned!!!

HASTA PRONTO !!