Erase USB Drive History

Registry is where all the "gems" traces are left ..but do backup your system if doing the registry  delete....so maybe just test out on a duplicate copy of your registry hive and work on it instead

a) Check this reading (http://www.forensicfocus.com/downloads/forensic-analysis-windows-registry.pdf) AND
b) Scripts dealing with the registry (http://search.cpan.org/~jmacfarla/Parse-Win32Registry-0.41/lib/Parse/Win32Registry.pm#SCRIPTS)

Extracted from the reading, take note of the following key registry paths:
a) HKLM \SYSTEM\MountedDevices
b) HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\
[This key lists any volume that is mounted and assigned a drive letter, including USB storage devices and external DVD/CDROM drives. From the listed registry values, value’s name that starts with “\DosDevices\” and ends with the associated drive letter, contains information regarding that particular mounted device. For instance, if the binary data for registry value “\DosDevices\F” contains “\??\Storage#RemoveableMedia” at the beginning of the value, it signifies a USB removable disk was connected to the system USB port. By correlating the entry with registry key LastWrite time, investigator would know when the removable device is connected. ]

c) HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR
[This key contains addition information about list of mounted USB storage devices, including external memory cards. This key when used in conjunction with two previous keys will provide evidential information. Actually this is what RegRipper (see below for more detail on it) will be supplying you]

========
Actually I see that to avoid traces being found, we should look at the tools used in forensic processes such as the well received RegRipper. Those information is exactly those details to be deleted off (though that may not be 100%).

Take a look at http://windowsir.blogspot.com/2008/08/regripper-news-and-mentions.html
- Note that the following will be sieve out:
- System name
- Device class ID
- Serial Number
- LastWrite time from the unique ID key, 'normalized' to Unix time
- The "FriendlyName" value from the unique ID key
- The ParentIdPrefix value, if available
- The DosDevice listed in the MountedDevices key, if the ParentIdPrefix value exists

So you can focus on the above parameter to do a search. For example, let start with "Device class ID" search in the registry and doing manual delete, this would hcan suffice, unless you are going for automated deletion. If you have the registry path, can simply input to

- RegStop (http://www.softpedia.com/get/Tweak/Registry-Tweak/RegStop.shtml) for deletion (but note that it is up to 12 entries, actually can't expect too much from free source right :)

Hope it helps ....