Which of the following is found within the unique instance ID key and helps investigators to map the entry from USBSTOR key to the MountedDevices key?

The correct answer is A. ParentIDPrefix. In the Windows Registry, HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR stores entries for each USB storage device. Within each device's unique instance ID subkey, the ParentIDPrefix value is a generated identifier that also appears in the MountedDevices registry key. Forensic…

Submitted by yuriko_h· Apr 18, 2026Disk Forensics

Question

Options

AParentIDPrefix
BLastWrite
CUserAssist key
DMRUListEx key

How the community answered

(52 responses)

A
87% (45)
B
8% (4)
C
2% (1)
D
4% (2)

Explanation

In the Windows Registry, HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR stores entries for each USB storage device. Within each device's unique instance ID subkey, the ParentIDPrefix value is a generated identifier that also appears in the MountedDevices registry key. Forensic investigators use this value as a link to correlate a specific USB device's USBSTOR entry with its corresponding drive letter or volume mount point recorded in MountedDevices, helping reconstruct exactly which drive letter was assigned to the device.

Topics

#Windows Registry#USB Forensics#Artifact Analysis#Digital Forensics

Community Discussion

No community discussion yet for this question.

Full 312-49 Practice