A question about arbitrary values in USB registry keys

I was recently teaching the SANS FOR500 Windows Forensic Analysis class in Canberra and I was asked a question about how we track the connection times for USB devices in the registry: My answer at the time was, “they are arbitrary” but I thought I should look into it a little bit more, and I’m […]