| Plugin | Hive | What it gives |
|---|---|---|
| usb | SYSTEM | USB devices |
| usbstor | SYSTEM | USB storage |
| usbdevices | SYSTEM | USB + WPD devices |
| mountdev | SYSTEM | Mounted volumes |
| mountdev2 | SYSTEM | Mounted devices enhanced |
| mp2 | NTUSER.DAT | MountPoints2 user USB traces |
| devclass | SYSTEM | DeviceClasses mapping |
| wpdbusenum | SYSTEM | Portable devices |
| bthport | SYSTEM | Bluetooth devices |
| bthenum | SYSTEM | Bluetooth enumeration |
Software
Windows Portable Devices(correlate VID/PID withSYSTEM\ControlSet001\Enum\USB)