top of page

USB Forensics

Universal Serial Bus flash drives, commonly known as USB flash drives are the most common storage devices which can be found as evidence in Digital Forensics Investigations. Digital forensic investigation involves following a defined procedure for investigation which needs to be performed in such a manner that the evidence isn’t destroyed.


The usage of USB drives in place of work may let nasty employees remove sensitive or confidential information from a system without any authorization. To resolve this issue, forensic examination of systems comes into the picture.


Using Registry Editor


It is a manual method to easily list the information of the last plugged-in USB storage devices. Press ‘Windows+R’ and type Registry Editor. This information can be found in the Windows registry at:

Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR

The details like the last plugged-in USB devices, the vendor of the USB, the name of the product, serial number, and version name can be seen.



Using PowerShell


This is a manual method to find artifacts. The same path can be used in the PowerShell to get the information on the last plugged-in USB, with the following command:

Get-ItemProperty -Path HKLM:\SYStem\CurrentControlSet\Enum\USBSTOR\*\* | Select FriendlyName


Using USBDeview


To use an automatic method to find artifacts, you can download USBDeview. This tool gives you an automated and graphical representation understanding of what USB devices were connected to the system.




Recent Posts

See All
Sanitizing Text

The Hidden Side of Text: Detecting and Cleaning Invisible Characters We often assume that what we see is what we get — especially with...

 
 
 
IPSec vs. TLS

When it comes to securing data over networks, IPSec (Internet Protocol Security) and TLS (Transport Layer Security) are two of the most...

 
 
 

תגובות


Programming and IT solutions guide on STENGE.info blog
Cybersecurity and Networking tutorials on STENGE.info
IT infrastructure solutions and technology tutorials
STENGE.info logo - Tech Blog for IT Solutions and Tutorials
bottom of page