Many people believe plugging in a USB drive leaves no trace once it's removed. In reality, Windows treats removable devices like permanent guests. Every USB storage device ever connected is recorded in the registry, along with its manufacturer, product name, serial number, and the last time it was seen. This makes USB activity one of the easiest insider threats to investigate during forensic analysis.

The demonstration, featuring command-line registry queries, shows a SanDisk Ultra drive's history persisting in the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR key long after removal.