When a USB storage device is inserted into the computer, a series of registry keys and system log files automatically updated records to reflect USB connection. In different computer operating systems, the registry and the log file identifier remained by these USB devices are unique with uniqueness. The information is stored in the registry and log, even when the computer system is turned off, it can still be obtained. Now how to find using traces of USB is anaylyzed briefly.%当一个USB存储设备被插入的计算机中时,一系列注册表键值和系统日志文件都自动更新其记录来反映这次USB设备的连接.在不同的计算机操作系统中,这些USB设备留在注册表和日志文件中的标识符是独一无二的,具有唯一认定性.这些信息保存在注册表和日志中,甚至计算机系统被关闭后仍然可以被获得.现就其如何寻找USB使用痕迹进行简要分析.
展开▼
