I have a USB device that enumerates with a different interface, VID, PID and serial number when commanded to do so, and I'd like to keep track of the physical device after this change occurs. My thought was to track it by its hub and port location. Most USB serial port devices have unique hardware ID's, so as you plug in more serial devices, each device is then allocated a unique COM port number. My approach is to compile an array of all COM port numbers that were historically allocated to a particular VID/PID combination.
On to Part 4 of our ongoing discoveries about USB forensics.
- Serial numbers for these versions are emailed to you after you place an order or can be found in Autodesk Account. If you have physical media (a DVD or USB key) for a 2013 or earlier product, your serial number and product key will be printed on the label of the product packaging. Example of label from 2011 version.
- Feb 05, 2018 Software to allow USB Devices based on serial number - so need to add serial number of over 120 devices so that only those devices can be used on work computers The serial number it works on is the one showing in device manager, which is why I need to find a way of retrieving that number.
A quick recap
So far we have managed to get details of two devices which have been connected to our image. We have looked at how to get:
We are now going to move on to the Volume Serial Number, this is created by Windows Vista and up Operating Systems each time the device is formatted. We will be looking in the EMDMgmt key for the Volume Serial Number, which according to this Technet blog around Windows Vista, is where the Operating system store details regarding “Ready Boost”; the idea behind Ready Boost was to use external USB devices as additional memory to increase performance. It never really took off. In my opinion this is a good thing from a forensics stand point, would we really want to be chasing down another USB device that has memory artefacts on it? I personally would rather have as much evidence in one place as possible. Especially when it comes to large scale jobs.
USB Hard Drive vs. USB Stick
As I mentioned in Part 3, one of the devices we are looking at is a cylindrical hard drive, it will be interesting to see if the Volume Serial Number exists in this key, as obviously it wont be fast enough to pass the benchmark…… let’s go find out.
Navigate to the following key:
SOFTWAREMicrosoftWindows NTCurrentVersionEMDMgmt
Oblivion vampire console command. And you will see the following
Find Usb Device Serial Number In Registry
As you can see “My Drive” which we identified as the Hard Drive is listed, and above that we see “FOR408-USB”, so the answer is yes, it will be listed here!
I have highlighted here the string at the end of the Key name, this is a Decimal value of the Volume Serial Number, which is a Hexadecimal value (isn’t the registry fun….). Convert this value, using Windows Calculator is probably easiest, into the Hex and you have your Volume Serial Number.
The Volume Serial Number of this device is “40034B65”. To confirm that this is correct there is another tool we can use, which is a command line tool called “Vol.exe”, this requires you to have the device connected, so use appropriate protection and document when and why you did it. The output of Vol.exe is shown below:
As you can see, the Volume Serial Number matches what we worked out manually above. Therefore showing that this device was installed on this machine and has not been formatted since (this is an important footnote, the Volume Serial Number can change for the device if it is formatted, as the Volume Serial Number is allocated after the Format!).
Make a note of the Volume Serial Number and the Volume Name for use in analysing the Link (.lnk) files, which I will cover later, as they can correlate this device to those Link files.
An important side note: As I have done more investigations I realised that this key will not be populated if the machine is deemed “too fast” for Ready Boost. This also changes depending on the OS
- Windows 7 – If an SSD is present Ready Boost is defaulted to off
- Windows 8 – If an SSD is present the system will test to see if Ready Boost is required
The reasoning behind turning off Ready Boost as far as I can tell is to do with write times to an SSD. As we all know SSDs are not as write tolerant as the older cylindrical disks therefore automatic defrag is disabled as is pre-fetch (which is another pain in the backside from a forensics standpoint!).
Knowing more about Ready Boost means that it should hopefully help to understand why a drive may not appear as expected in the EMDMgmt key; Windows wouldn’t attempt to make a cylindrical disk a Ready Boost device as there would be no increase in performance associated with it.
Want to find Windows product key or recover forgotten Windows 10 password? Learn how to recover Windows product key from an external or unbootable drive.
Need to reload the operating system but you’ve lost the product key for Microsoft Office 2016 installed on your computer? Is it possible to retrieve Windows 10 product key off of my old computer’s external hard drive?
Even, if your computer is broken or unbootable, you can try to recover your Windows product key and reinstall the OS.
To find your Windows product key, it is recommended to use Password Recovery Bundle which is a must-have password recovery tool that could bypass Windows password, retrieve forgotten passwords to your database, email accounts or protected Office/PDF documents, find lost product keys for any Windows PC, and much more.
In this Windows product key recovery tutorial, we’ll show you how to use Password Recovery Bundle to recover Windows 10 / 8 / 7 / Vista / XP product key from an external or unbootable drive. Here we go.
Quick Navigation:
How to Recover Windows 10 Product Key from External Drive
In order to view the product keys stored on a broken computer, you can unplug the hard drive and then connect it to a working computer as an external drive. Afterward, follow the steps below to recover Windows product key:
Step (1): First of all, open up the Password Recovery Bundle. Click on Start Recovery button and you’ll get a list of options to recover various passwords, along with two additional options to recover product key:
Product Key – This lets you retrieve product keys from your current Windows installation.
Product Key (Advanced) – This can recover product keys from unbootable Windows installation on an external hard drive.
Obviously, here we have to choose the “Product Key (Advanced)” option in order to recover Windows product key from external hard drive.
Step (2): When you see the following dialog box, browse to choose the SOFTWARE registry file stored in the external hard drive. By default, the SOFTWARE file is located in the directory /Windows/System32/Config.
Step (3): Once you’ve clicked the OK button, the Windows product key finder software will load the selected registry file and then immediately show product keys for Windows, Microsoft Office, SQL Server, Adobe and many other programs you’ve ever installed.
This is how you can easily find Windows product key from external hard drive. The retrieving method will be the same for all the Microsoft Windows operating systems.
How to Recover Windows 10 Product Key from Unbootable Drive
How can I find Windows product key on a crashed or unbootable computer? If you’re unable to connect its drive to a working PC, the only solution is to boot your crashed computer from a bootable media (CD, USB, etc.) and run a product key finder utility from there.
Usb Serial Number
Thankfully, Password Recovery Bundle allows you to create a bootable CD or USB drive, so you can easily extract lost product keys from unbootable drive. Here’s how to do so:
Step (1): When you launch Password Recovery Bundle, click on Windows Password button and choose “Create Password Reset Bootable Disk” from the drop-down menu that appears.
Step (2): By default, the built-in ISO image is filled in automatically. You just need to choose a target media (CD or a USB) and then click on the Start Burn to make a bootable media.
Step (3): When the bootable media is ready, connect it to your unbootable computer. Turn on the machine and quickly press a dedicated key (F12, F2, DEL, F8, Esc, etc.) to bring up the boot options menu. Choose the bootable media you created and press Enter.
Usb Serial Number Find
Step (4): When successfully booting off the CD or USB drive, you’ll reach the PCUnlocker screen. Just skip the Windows password reset feature and proceed to click the Options button at the bottom, then click “Find Product Key” option.
Find Usb Drive Serial Number
Step (5): Now you’ll see a new window popping up with your Windows product key, as well as license keys of other programs extracted from your unbootable drive. Finally, you can click the Save button to export the product keys to a text file and then save it to your USB drive.
Thus, you can see how simple is to recover Windows 10 product key or the product key for other software from an unbootable hard drive.
Conclusion
Usb Serial Controller Driver
Keeping track of all your software product keys can be a pain, especially when your computer is unbootable or broken. Password Recovery Bundle makes it easy to recover Windows product key from an external or unbootable drive, without having to tear your hair. Try the software to get your product key before it’s too late!
You may also be interested in checking out: