The invention provides a deleting method,
system, device and medium based on
USB device plug-pull records under an
operating system, and belongs to the technical field of
USB device plug-pull records, and the deleting method comprises the steps of registry permission privilege lifting,
USB path
data extraction, PID / VID rule establishment, and registry full
quantum item traversal matching deletion. Exporting and replacing the
system file, and after restarting, loading an old-version
system file and deleting the old-version system file for the second time; identifying NK blocks based on an HIVE
file format, screening target blocks which are in a deleted state and have names containing DISK / USB or matched PID / VID, and generating equal-length random character strings to cover name data; and finally, deleting the old file, associating the log and executing safe erasing of the
residual space of the disk. By replacing a registry file,
processing old file residues, covering multi-dimensional data and erasing a disk, the USB equipment plugging and unplugging
record is thoroughly cleared, and anti-forensics
recovery is effectively prevented.