usb forensics

Windows keeps a surprisingly durable "memory" of every USB device that has ever been plugged in — not just a fleeting cache, but persistent registry entries that can reveal vendor and product IDs, serials, install timestamps and other identifying metadata long after the device is gone...