Microsoft has addressed concerns regarding Windows retaining registry entries for USB storage devices after they are disconnected. According to official documentation, this mechanism has been in place for over a decade, dating back to 2012.
When a USB mass storage device is connected, the Windows Plug and Play service creates a registry key under USBSTOR. This entry stores details such as device name, hardware identifiers, and timestamps for connection and removal. The system retains these records to enable faster recognition upon reconnection.
The company clarifies that the system cannot distinguish between a temporary disconnection and a permanent removal of a device. These records, often referred to as ghost devices, are managed by the Usbstor.sys driver and apply specifically to mass storage devices, excluding peripherals like keyboards or cameras.
Users can manually remove these records through the Device Manager by enabling the display of hidden devices. IT administrators can utilize the DevNodeClean tool for batch management. Microsoft notes that similar hardware tracking mechanisms exist in Linux via udev and macOS through IOKit.
