top of page

USB Forensics

Universal Serial Bus flash drives, commonly known as USB flash drives are the most common storage devices which can be found as evidence in Digital Forensics Investigations. Digital forensic investigation involves following a defined procedure for investigation which needs to be performed in such a manner that the evidence isn’t destroyed.


The usage of USB drives in place of work may let nasty employees remove sensitive or confidential information from a system without any authorization. To resolve this issue, forensic examination of systems comes into the picture.


Using Registry Editor


It is a manual method to easily list the information of the last plugged-in USB storage devices. Press ‘Windows+R’ and type Registry Editor. This information can be found in the Windows registry at:

Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR

The details like the last plugged-in USB devices, the vendor of the USB, the name of the product, serial number, and version name can be seen.


 

Using PowerShell


This is a manual method to find artifacts. The same path can be used in the PowerShell to get the information on the last plugged-in USB, with the following command:

Get-ItemProperty -Path HKLM:\SYStem\CurrentControlSet\Enum\USBSTOR\*\* | Select FriendlyName

 

Using USBDeview


To use an automatic method to find artifacts, you can download USBDeview. This tool gives you an automated and graphical representation understanding of what USB devices were connected to the system.




36 views0 comments

Recent Posts

See All

Cyrillic Alphabet

Exploring the Cyrillic Alphabet: A Beginner's Guide Have you ever come across the Cyrillic alphabet and wondered what it's all about? Maybe you've seen it on Russian websites, or perhaps you've notice

MacOS | Recording a Packet Trace

A packet trace is a record of traffic traveling across the network. It’s useful for investigating complex network problems related to both correctness and performance. Once you start a packet trace on

DNS Guard

Absolutely everything is connected to the internet these days, from TV to smart light bulbs, from mobile devices to smart cars. Given those ads and ad trackers are everywhere on the Internet, a browse

Commenti


bottom of page