Currently working an investigation that is related to external media (usb devices cdroms etc). I have two questions if i might. First when autoplay scans the filesystem on the media and you can see all the file names and folder names, is this information being logged anywhere within the O/S?
Second question: Does the windows indexing service that can be used to speed up searches for files within windows also index external media if it is plugged in log enough? If so, where is that index located and has anyone had any experience with it?

Christian....

Harlan,
    Thanks for the response. I haven't been able to locate much on the issue on MS Website. I have an idea I just haven't had time to test. I am going to put a large amount of text documents on a thumb drive. Snapshot the registry before plugging anything in, and get a DD image of the OS drive. Then I'll reboot plug in the thumb drive for a few hours and with the indexing service turned on and maybe even run a few searches that include all drive letters available. Then snapshot again and re-image. I'll compare the before and after of the registry as well as do hash analysis and see what files change. On the files that turn up I'll just run diff against them and see the result.

I'll post the result when I have it.

Thanks the ideas.

christian...