Whilst writing a presentation on USB Forensics, I was hit with a problem with ReadyBoost being disabled on my Virtual Machine. The message would read

This device cannot be used for ReadyBoost. ReadyBoost is not enabled on this computer because the system disk is fast enough that ReadyBoost is unlikely to provide additional benefit.

Looking around on the internet most answers point to setting Superfetch service to automatic and starting it. This does not work for this error, ReadyBoost is working, but thinks it knows best!

After a lot of annoying pages I decided to take matters into my own hands! Within the SYSTEM hive (under CurrentControlSet) is the Services key and under there is “Rdyboost”, this contains all of the parameters that ReadyBoost uses to decide on if your USB Stick is up to the challenge.

Under the “Attachstate” subkey there will be a number of settings, on this VM there are 2x USB devices and 1x HDD, on my live system it is not so easy, there are several HDD all with ambiguous names (found the right one with trial and error). This value will be DWORD=2 to produce the above error, simply set it to DWORD=0 to allow ReadyBoost to come back to life.

The properties of the USB stick now show the following:

Although the USB stick is not fast enough to be used, it does prove that it is now working. The reason for setting this up was to populate the EMDMgmt key for forensic analysis.