The application provides a
USB device plug-in
record deletion method,
system, device and medium based on an
operating system, belongs to the technical field of
USB device plug-in records, and realizes complete deletion of the
USB device plug-in
record through registry permission
privilege escalation, USB path
data extraction, PID / VID rule establishment, full registry subentry matching deletion, export and replacement of a
system file, loading of an old version
system file after restart for secondary deletion, NK block identification based on a HIVE
file format, screening of target blocks with a deleted state and a name containing DISK / USB or matching PID / VID, generation of an equal-length
random string to cover name data, and final deletion of old files, associated logs and execution of disk remaining space safe erasure. Through replacement of a registry file,
processing of old file residues, multi-dimensional data covering and disk erasure, complete deletion of the USB device plug-in
record is realized, and anti-forensic
recovery is effectively prevented.