±Forensic Focus Partners

±Your Account


Nickname
Password


Forgotten password/username?


Membership:
New Today: 3
New Yesterday: 5
Overall: 27201
Visitors: 70

±Follow Forensic Focus

Join our LinkedIn group

Subscribe to news

Subscribe to forums

Subscribe to blog

Subscribe to tweets

USB Removal Date/Time

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Go to page Previous  1, 2 
  

Re: USB Removal Date/Time

Post Posted: Tue Jan 29, 2013 12:02 pm

How would you recommend to the OP to use these artifacts in pursuit of their stated goals?  

keydet89
Senior Member
 
 
  

Re: USB Removal Date/Time

Post Posted: Wed Jan 30, 2013 1:30 am

How's that for weird timing?

I just finished watching the webinar on this forum that Jacky Fox did on USB registry artifacts, right hand side of the screen if you want to watch it.

She does mention or allude to the possibility that there may be some artifacts to show the removal of a USB device, and she talks about a way to link USB via serial number to .lnk files.

May be worth an email to get a copy of her dissertation or whitepapers she may have done.  

Adam10541
Senior Member
 
 
  

Re: USB Removal Date/Time

Post Posted: Wed Jan 30, 2013 8:19 am

- Adam10541

May be worth an email to get a copy of her dissertation or whitepapers she may have done.


That's not at all necessary...the dissertation and code were linked at the school site when I first watched her interview...  

keydet89
Senior Member
 
 
  

Re: USB Removal Date/Time

Post Posted: Wed Jan 30, 2013 2:34 pm

- Adam10541

May be worth an email to get a copy of her dissertation or whitepapers she may have done.



The dissertation and scripts are available here.

digitalfire.ucd.ie/?p=337

Happy reading it's quite long but the USB artifacts diagram might help you.  

JackyFox
Member
 
 
  

Re: USB Removal Date/Time

Post Posted: Sun Feb 03, 2013 9:44 am

Thanks for the help and the link, folks.
Appreciate it.
-=Art=-  

4n6art
Senior Member
 
 
  

Re: USB Removal Date/Time

Post Posted: Sun Feb 10, 2013 8:09 am

So...what did you find out?  

keydet89
Senior Member
 
 
Reply to topicReply to topic

Share this forum topic to encourage more replies



Page 2 of 2
Go to page Previous  1, 2