How to delete data about USB flash drives in the Windows registry. Cleaning traces from USB flash drives in the registry A program for deleting USB connection history

Now there was a discussion in the forum about how to determine under which account the USB was mounted, but I have the opposite task. It is necessary, without having administrator rights, as a user with limited rights, to remove information about connected USB devices from Windows OS.

The task is complicated because there are no rights to change the registry. It is also not possible to solve the problem by loading a LiveCD.

Irina will “thank you very much” after the users to whom she “drew attention” use these tips.

To be honest, we got ahead of ourselves, I myself wanted to continue the topic in this direction)))

I think the initial data is enough, but nevertheless I will give the details.

Let me make a reservation right away that we are not talking about a certified object and not about ensuring the information security of confidential information (in some sense). The question was “purely for myself.” For example, I don’t want to have data about connected, personal, USB devices in the system, on my work computer.

God protects those who are careful and it is unknown how these data may affect them in the future. You never know who in management would want to find a scapegoat for leaking non-confidential but working data. Or hold them responsible for the spread of a virus on a corporate network. In short, you can come up with a lot of things.

In a word, we will consider my question from the point of view of an attacker who wants to delete compromising information.)))

We consider the experimental computer as: an ordinary working computer included in the corporate network of the organization; Windows XP OS; authorization via Active Directory, physical access available; there is access to the BIOS; limited user rights; Loading from any media is possible (for example, from LiveCD).

How to clear data about USB flash drives in the Windows registry.

Comments and reviews: 9

1. Ilya 19.05.2011
>>>Attention! These sections also contain information about the hard drives installed on the computer. Do not delete this information.

Question: If I mistakenly delete data about hard drives along with information about flash drives, what then? Kaput system?

Answer:
Yes you are right. Sometimes, even with full access rights set, it is not possible to delete the specified keys. But there is a way out. You need to run the registry editor with system rights.

I will write below how to do this under Windows XP. I haven't tried it on Vista or Windows 7.

So. In order to run a program in Windows XP with system rights, you need to run it through the “Task Scheduler”. Make sure you have this service enabled:

Control Panel - Administration - Services - Task Scheduler.

If everything is in order, we create a BAT file with the following content:
at 21:01 /interactive regedit.exe

21:01 is the time (you will have your own value) to start the task. If your system clock shows the time 20:59, then the registry editor (regedit.exe) will be launched at 21:01, in 2 minutes.

Then run the BAT file.
At 21:01 we admire the registry editor running under system rights.

Now you can edit any data in the registry.

8. Afanasy 08.07.2013
Reply to reply to comment #3
“I’ll write below how to do this under Windows XP. I haven’t tried it on Vista or Windows 7.”

I tried it in Windows 7, but this method no longer works. The Registry Editor starts and is visible in processes, but the system does not open its windows for security reasons. What is reported when you try to create a task in the task scheduler.

How to remove old USB device drivers from Windows?

Almost every user connects a phone, tablet, reader, flash drive and external HDD to a computer. When working with these devices, Windows installs their drivers. At the end of use, they are not deleted from the computer (that is, they gradually accumulate) and, just like temporary files, unnecessary registry entries clutter the system.

In addition to this, if devices are disconnected from the USB port incorrectly (they are pulled out without software shutdown using the “Eject” function), then the installed drivers not only remain in the system, but also continue to function. Because of this, they often become the cause of a software conflict when connecting another USB device (the system “does not see” the device, gives errors, freezes).

This article will help you avoid all these troubles: it will tell you how to completely remove the driver of an unused USB drive or gadget from the operating system, and how to automatically uninstall all USB drivers.

Removal using standard means

Surface cleaning

1. Open the Start menu.

2. Right-click in the “Computer” panel that appears. From the list of commands, select “Properties”.

3. In the left column, click “Device Manager”.

4. In the manager window, in the horizontal menu, open the “View” section and click “Show hidden devices”.

5. Open the “USB Controllers” directory.

6. Remove an old or unused driver: right-click on its name → click “Delete”.

Deep cleaning

1. Hold down the Win key and press the Pause/Break key. Or open: Start → right-click Computer → Properties.

2. In the window that opens, in the left panel, click “Advanced system settings”.

3. On the Advanced tab, click the Environment Variables button.

4. In the top block, click “Create”.

5. In the New User Variable window:

in the “Variable name” line, enter - devmgr_show_nonpresent_devices;
in “Variable value” - 1.

6. Click OK in the Variable panel and in the Environment Variables window.

7. Return to the system properties window (Win+Break) and click “Device Manager”.

8. In the manager, open: View → Show hidden...

9. Click the “Update configuration...” button (the last one in the panel).

10. Icons of unused drivers in the manager are grayed out (that is, you can remove this driver). Open the following directories one by one and remove unnecessary elements (right-click on the name → Delete):

Non-plug and play device drivers

Advice! In this directory you can also remove old drivers installed by programs that have already been uninstalled from Windows (for example, the Comodo firewall package).

USB controllers

Disk devices

This device section displays installed drivers for flash drives, readers, and hard drives. Transparent object icons indicate that they are not in use (not connected). This means you can safely get rid of them.

11. Once cleaning is complete, restart your PC.

Automatic removal by USBDeview utility

1. Copy this link into the address bar of your browser - http://www.nirsoft.net/utils/usb_devices_view.html#DownloadLinks (official website of the utility). And then press "ENTER".

2. On the page that opens:

if you have a 32-bit system, click the first link “Download USBDeview”;
if 64-x, the second - “... for x64 systems”.

3. Unpack the downloaded archive: right-click on it → select “Extract all...” → in the “Extract...” window, click “Extract”.

4. Open the unzipped folder. Run the USBDeview executable file with administrator rights.

5. The utility window displays a list of all drivers installed in the system. Disabled elements are marked with red “chips”.

To remove a driver from Windows, select it with a mouse click, and then click the “Trash” icon in the USBDeview panel. Or right-click on it and select “Uninstall Selected Devices” from the context menu.

Note. In addition to the removal function, USBDeview allows the user to disable/enable the driver and view its properties.

Removing all USB device drivers

Global driver cleaning can be performed using the DriveCleanup utility (download link - http://uwe-sieber.de/files/drivecleanup.zip).

1. Unpack the archive downloaded to your computer.

2. If you have 32-bit Windows, open the “Win32” folder; if you have 64-bit, open the “x64” folder.

3. Run the “DriveCleanup” file as administrator.

After launch, the utility will automatically perform cleaning. When the procedure is complete (when the message “Press any key” appears in the console window), press any key.

Good luck in setting up the system!

izbavsa.ru

Let's cover our tracks. How to make Windows delete history, logs, caches and forget everything

Lists of open files and devices connected via USB, browser history, DNS cache - all this helps to find out what the user was doing. We have compiled step-by-step instructions on how to remove traces of your activities in different versions of Windows, Office and popular browsers. At the end of the article you will find several scripts that will help you automatically keep your machine clean.

1. Clear lists of recent places and programs

Let's start cleaning with lists of recent places and programs. The list of recent (in Windows 10 - frequently used) programs is in the main menu, and the list of recent places is in Explorer.

How to turn off this disgrace? In Windows 7, right-click on the “Start” button, select “Properties” and in the window that appears, uncheck both boxes in the “Privacy” section.

Disable storage of the list of recent programs in Windows 7

To clear the list of recent places and documents, you need to delete the contents of the %appdata%\Microsoft\Windows\Recent directory. To do this, open the command line and run two commands:

It also wouldn't hurt to delete the contents of the %appdata%\microsoft\windows\recent\automaticdestinations\ directory. It stores the latest files that appear in the jump list:

To ensure that recent files are cleared automatically when you exit, you must enable the "Clear the history of recently opened documents on exit" policy, which is located in the "User Configuration\Administrative Templates\Start Menu and Taskbar" section.

Now let's move on to Windows 10. You can disable the list of recently added and frequently used applications through the Settings window. Open it and go to the “Personalization” section, “Start”. Turn off everything that is there.

Disabling program list storage in Windows 10

It seems that the problem has been solved, but this, alas, is not entirely true. If you enable these parameters again, then all lists with the same composition will appear again. Therefore, you will have to disable this feature through Group Policy. Open gpedit.msc and go to User Configuration\Administrative Templates\Start Menu and Taskbar. Enable the following policies:

“Clearing the list of recently used programs for new users”;
“Clear history of recently opened documents on exit”;
“Clear notification log on tile when exiting”;
“Remove the list of programs pinned to the Start menu.”

Group Policy

Clearing recent places in Windows 10 is easier than in Windows 7. Open File Explorer, go to the View tab and click the Options button. In the window that appears, disable the “Show recently used files in the Quick Access Toolbar” and “Show frequently used folders in the Quick Access Toolbar” options. Don't forget to click the "Clear" button.

Windows 10 Folder Options

As you can see, such a simple task as cleaning up the last objects has a rather complicated solution. Without editing group policies - nowhere.

2. Clear the list of USB drives

At some sensitive facilities, only flash drives registered in the log are allowed to be connected to the computer. Moreover, as usual, the magazine is the most ordinary one - paper. That is, the computer itself does not in any way restrict the connection of unregistered drives. It doesn’t limit, but it records! And if during the check it is discovered that the user connected unregistered drives, he will have problems.

We under no circumstances advise you to try to steal military secrets, but the ability to clear the list of recently connected drives can be useful in other life situations. To do this, look at the following registry keys:

Here they are - all the drives that you connected to your computer.

Registry section with drive connection history

It would seem that you just need to take it and clean everything. But it was not there! Firstly, the permissions for these registry branches are set in such a way that you cannot delete anything even in “seven”, not to mention “ten”.

Secondly, assigning rights and permissions manually takes a long time, especially if there are many drives. Thirdly, administrator rights will not help. The screenshot above was created when I performed the delete operation with admin rights. Fourthly, in addition to these two sections, you need to clean a long list of sections. Moreover, they need not just to be deleted, but to be edited correctly.

If for some reason you need to do everything manually, then search for the keywords MountPoints, MountedDevices DeviceClasses and RemovableMedia. But it’s much easier to use a ready-made program that will do everything for you. Some forums recommend USBDeview for this. However, I tested it and declare that it does not clear information from all the necessary sections. USBSTOR And USB continue to contain information about connected media.

I can recommend the USB Oblivion program. Run it, check the “Perform real cleaning” checkbox. You can turn on the “Save .reg cancel file” option or not, but if the goal is not to test the program, but to prepare for an upcoming computer inspection, then it’s better to turn it off.

USB Oblivion

The program not only cleans the registry, but also displays a detailed log of its actions (see below). When it finishes, there will be no mention of connecting drives to the computer.

USB Oblivion in action

3. Clear cache and browser history

The third point in our tutu is clearing the cache and browser history. There are no difficulties here - each browser allows you to reset the list of recently visited sites.

Continuation is available only to subscribers

Option 1. Subscribe to Hacker to read all materials on the site

Subscription will allow you to read ALL paid materials on the site within the specified period. We accept payments by bank cards, electronic money and transfers from mobile operator accounts. More about subscription

Option 2. Buy one material

Interested in information, but can't pay for a subscription? Then this option is for you! Please note: this purchase method is only available for content published more than two months ago.

How to remove traces of a flash drive in Windows?

How to remove traces of a flash drive in Windows

Flash drive – uses flash memory. Convenient and quite common among users of individual computers. In individual cases, there is a need to work with a flash drive, but the traces left on the computer are not needed. This is possible in the case where the employer prohibits the use of any unregistered storage medium. Either in order to maintain the confidentiality of the presence of a flash drive on someone else’s computer, in order to avoid leakage of valuable information, theft of intellectual property, trade secrets, maintaining a high level of information security, or infection of computer networks with malicious computer software, viruses, computer worms. This causes not only material damage, but also damage to the company's image. There is an option to ban the off-duty use of the employer’s computer equipment and software. Flash drives differ in the amount of information they can hold, their manufacturing companies, their design, and their sizes, but the principle of storing information about them in the computer’s memory is the same.

There are several options for removing traces of a flash drive. Let's look at options for removing traces of a flash drive from Windows memory using specific examples:

Removing traces of a flash drive manually. After finishing working with the flash drive and disconnecting it from the computer, do the following:
- Press start
- Select the Execute line,
- Type REGedit and click ok.

From the registry branches that appear, select HKEY_LOCAL_MACHINE\SYSTEM\MountedDevices
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceClasses\
WINDOWS\setupapi.log

It is in them that the history of connecting flash drives is saved.

In each folder, by right-clicking and selecting “delete”, we erase the information about the flash drive.

This option is only possible if you log into WINDOWS as an administrator. Under the name user or user, you will not be able to remove traces of the flash drive manually, you need to change the user.

To change your username: Click Start, select Settings menu bar, Control Panel, go to Administrative Tools, select Computer Management, and change the name from User to Administrator. In individual cases, this cannot be done due to the simplicity of the installed version for users. Then, we advise you to use the second option.

As a result of manual cleaning, invalid links may appear in the registry, so some specialists do not encourage its use.

2. Removing traces of a flash drive using a utility program. This method is faster and better quality. The downloaded programs will repeatedly come to your aid in matters related to cleaning registries. The algorithm of actions in this case is as follows. Let's look at it using a specific example:

The work with the flash drive is finished. Get her out.

Download the USBDeview program from the Internet to your desktop. This is a utility that displays a list of all previously connected to your personal computer: mobile phone, flash drive, etc. Not only the time of the last connection is indicated, but also the serial numbers of the device and its description. You can download the program for free. Designed for Windows 2000/XP/Vista/Server 2003/Seven (operating systems) in English. Developed in 2006, latest updates in October 2010.

In the folder copied to your desktop, select the compressed zip folder – USBDeview, and extract all the files from it.

Open the newly created folder on your desktop and run the utility program by clicking

Our flash drive was identified as second on the list. Copy the program USBOblivion utility to your desktop from the Internet. This is a free program designed to remove traces of connections from CD-ROMs and USB drives. Removes Windows 2000, Windows XP, Windows 2003, Windows Vista, Windows 7 from the registry. There are both 32 and 64 versions.

The USB Oblivion utility is designed to erase traces of connecting USB drives and CD-ROMs from the memory of Windows 7, Windows 2000, Windows 2003, Windows XP, Windows Vista, both 32 and 64-bit versions. There are 4 versions of the program, 1.3.0.0. is the latest and most updated, automatic disk shutdown has been added. The program is fully automated, more automated, its plus is that it can clean USB Sidi-roms.

Disconnect all USB devices from the computer. The program does not erase anything by default, do not forget to check the appropriate box. Reg file is created in the Documents folder and is created with a detailed report.

·In the folder copied to your desktop, select USB Oblivion 32 (compressed Zip folder), extract all files from it. They will be copied to a separate folder, which you will find on your desktop.

Open the usboblivion folder, open USBOblivion32.exe (cleanup utility).

Select the checkbox: perform real cleaning and click the cleaning button.

Check the result using the USBDeview program..

Here's what happened in our case:

Traces of our flash drive in Windows have been deleted. We wish you successful work too. It is convenient to deal with this program, it is reliable, and, most importantly, it is free to download.

We looked at an example of deleting information about a flash drive using the example of a specific program. Today the Internet offers a large selection of programs from different manufacturers. It is possible to use a flash drive so that there is no information left about it at all and then you don’t have to delete it. To do this, install a Russian tweaker on a flash drive that works without installation. After launching it, in the settings, indicate not saving the document history, search history, etc. Select the item: “Clear paging file”. Don't forget to disable the Recycle Bin before turning off or restarting your computer. Before removing the flash drive, you must close edited or simply open files. Otherwise, there will be a lot of temporary files left. A good option would be to create a default temporary folder in Word and empty it from time to time. Review Word settings, document history: click deny. Right-click on My Computer, select Manage, then Device Manager. Turn on View menu, select: show hidden devices. Remove pale gray devices, i.e. missing in the “Storage Volumes” and “Universal Serial Controllers” sections. USB bus." Experiment, choose the option that suits you.

Good evening dear visitors of my blog!!! It's been a while since I wrote anything new. I sat and thought, and remembered an interesting topic that I came across at the session. The topic concerns the registry and connecting USB flash drives; during the classes we looked at writing code to remove a flash drive from the system in safe mode using Free Pascal. The code has been disassembled as it should be and I don’t see any point in considering it within the framework of this topic, but I will tell you how to clean the traces left by flash drives that you once connected.

How to clean the registry from USB traces?

We will perform cleaning using the standard Regedit product. It starts like this: “Start - Run - regedit”

The main Registry Editor window will open. Now you will need to find the following subsections:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\USBSTOR
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\USBSTOR

Each of these sections stores data about connected flash drives. Entries with the Disc prefix can be safely deleted. As an example, I provide screenshots with the contents of these sections in my registry.

This is the content of sections numbered 1 - CurrentControlSet

Here you see the contents of the section - ControlSet001

Well, here, as you probably already guessed, the section entries are ControlSet002

Records with the Disc prefix are selected and deleted.

Why clear entries from the registry?

If you connect a lot of flash drives to your computer, then your registry begins to become clogged with this garbage, as a result of which with each new flash drive the recognition process will begin to slow down, but do we need it?

Is it possible to simplify (speed up) the cleaning procedure?

Yes, it's possible! To do this, you need to use a program, as an example I can give - Usb Oblivion. The program is easy to find on the Internet, it is free, and weighs very little.

We run the program as an administrator, check the “Perform real cleaning” checkbox and click the “Cleaning” button - the job is done.

Good afternoon, dear readers of the blog site, today I want to tell you how to delete data on USB Flash Drives in the Windows registry. This article is a continuation of the article. All information about any USB drives ever connected to a computer is stored in the system registry. If many flash drives of different models and manufacturers are connected to the computer, then over time a lot of garbage accumulates in the registry. As a result, the process of identifying and connecting a new device begins to take considerable time and slows down the system.

There is only one way out. You need to periodically clean the registry sections that store data about connected flash drives and other USB drives. Cleaning these partitions will speed up the connection of new USB devices and the operation of the system as a whole.

Cleaning must be done using the Regedit system program. It starts like this.
Start - Run - Regedit

Registry sections that store data about any USB drive ever connected to a PC - Flash drives, external hard drives, as well as cameras, phones, flash players and other devices that were recognized as an external USB drive when connected to a PC. Here you can delete all subsections with the Disc prefix.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\USBSTOR
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\USBSTOR

From the screenshots it is clear that hubs and HDD were also connected through the hub

If you don’t want to clean it manually, there is also free software, for example USB Oblivion. Launch the utility

Check the box Perform real cleaning

We see that everything is complete and many entries have been deleted from the registry. Let's check the registry. Please note that there is no USBSTOR folder.

Well, lastly, let’s look at the USBDeview program, everything is clean too.

Here, dear readers, is where data about your flash drives is stored, so if you need to delete something, then start.

Good day... Free program USBDeviewis designed to display detailed information about all USB devices (flash card, mobile phone, smartphone, camera, mouse, printer, etc., etc.) ever connected to your computer or laptop, netbook. It doesn’t matter whether it is currently connected or not. This utility creates with A list of all USB devices with the ability to remove them from the system if necessary.

During the life of a computer, the user constantly connects or disconnects various USB devices (smart, mouse, printer, etc.) to it.As is known (not to everyone) that every device that is connected to a computer via a USB port will definitely remain in the system (all information about connected devices is recorded ) its trace in the form .

List of all USB devices with the ability to remove them from the system - USBDeview

USBDeview program capabilities

device name/description
prohibit and allow the operation of devices
date and time when the device was added and time of last connection
disable and change the device letter
serial number
open device settings in the system registry editor
product and manufacturer identification numbers
assign device autostart
can uninstall USB devices. Which you have used before
copy its properties to the clipboard and display information about it as an HTML report
disconnect those that are currently connected to your computer
assign command execution when connecting and disconnecting a USB device to a computer port

Installing and using the USBDeview program

You can download the program from this link. The archive contains a 32 and 64 bit version in Russian. You need to select the one you need and tap on the exe file. USBDeview does not require installation ( - version). The main program window looks something like this.

Pay attention to the top panel where the red, green and blue circles are located, namely the green one. This means that the device is currently active.

When you right-click on any device, you can select:disabling a USB device, deleting it, properties, viewing content, etc. Also pay attention to the controllability .

Double tapping on the selected device will show you the properties of this device.

The program also has such a useful function as “Open in Registry Editor”. To open this function, select the desired device. Click on it with the right mouse button. Then select the appropriate item.

After which a direct transition is made to the registry editor with this driver.

Conclusion

That's basically all there is to it, I think that the program will be useful to any PC user. With this program you can deny, allow, or remove selected devices. And also solve many different problems with drivers.