@@ -66,6 +66,7 @@ public static List<TraceCategory> ScanAllTraces()
6666 ScanDeliveryOptimization ( ) ,
6767 ScanWindowsErrorReporting ( ) ,
6868 ScanFontCache ( ) ,
69+ ScanUsbDeviceHistory ( ) ,
6970 } ;
7071 cats . RemoveAll ( c => c . Items . Count == 0 ) ;
7172 return cats ;
@@ -446,6 +447,49 @@ private static TraceCategory ScanFontCache()
446447 return cat ;
447448 }
448449
450+ private static TraceCategory ScanUsbDeviceHistory ( )
451+ {
452+ var cat = new TraceCategory
453+ {
454+ Name = "USB Device History" ,
455+ Description = "Registry records of previously connected USB devices, SetupAPI logs" ,
456+ } ;
457+
458+ try
459+ {
460+ using var usbstorKey = Microsoft . Win32 . Registry . LocalMachine . OpenSubKey (
461+ @"SYSTEM\CurrentControlSet\Enum\USBSTOR" ) ;
462+ if ( usbstorKey != null )
463+ {
464+ foreach ( var deviceClass in usbstorKey . GetSubKeyNames ( ) )
465+ {
466+ using var classKey = usbstorKey . OpenSubKey ( deviceClass ) ;
467+ if ( classKey == null ) continue ;
468+ foreach ( var serial in classKey . GetSubKeyNames ( ) )
469+ {
470+ cat . Items . Add ( new TraceItem
471+ {
472+ Path = $@ "HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR\{ deviceClass } \{ serial } ",
473+ SizeBytes = 0 ,
474+ IsDirectory = false ,
475+ } ) ;
476+ }
477+ }
478+ }
479+ }
480+ catch { }
481+
482+ var setupApiLog = Path . Combine ( Environment . GetFolderPath ( Environment . SpecialFolder . Windows ) ,
483+ "inf" , "setupapi.dev.log" ) ;
484+ AddFile ( cat , setupApiLog ) ;
485+
486+ var setupApiAppLog = Path . Combine ( Environment . GetFolderPath ( Environment . SpecialFolder . Windows ) ,
487+ "inf" , "setupapi.app.log" ) ;
488+ AddFile ( cat , setupApiAppLog ) ;
489+
490+ return cat ;
491+ }
492+
449493 // ═══════════════════════════════════════════════════════
450494 // Helpers
451495 // ═══════════════════════════════════════════════════════
0 commit comments