±Your Account
Membership:
New Today: 1
New Yesterday: 3
Overall: 24197
Visitors: 56±Latest Webinar
±Latest Articles
· Geo-tagging & Photo Tracking On iOS
· KS – an open source bash script for indexing data
· Mobile Device Geotags & Armed Forces
· Categorization of embedded system forensic collection methodologies
· Interpretation of NTFS Timestamps
· What are ‘gdocs’? Google Drive Data – part 2
· What are ‘gdocs’? Google Drive Data
· Bad Sector Recovery
· Forensic Artifact: Malware Analysis in Windows 8
· Windows 8: Important Considerations for Computer Forensics and Electronic Discovery
· KS – an open source bash script for indexing data
· Mobile Device Geotags & Armed Forces
· Categorization of embedded system forensic collection methodologies
· Interpretation of NTFS Timestamps
· What are ‘gdocs’? Google Drive Data – part 2
· What are ‘gdocs’? Google Drive Data
· Bad Sector Recovery
· Forensic Artifact: Malware Analysis in Windows 8
· Windows 8: Important Considerations for Computer Forensics and Electronic Discovery
±Follow Us
±Latest Jobs
Back to top
Skip to content
Skip to menu
Back to top
Back to main
Skip to menu
Go to page Previous 1, 2
That's not at all necessary...the dissertation and code were linked at the school site when I first watched her interview...
The dissertation and scripts are available here.
digitalfire.ucd.ie/?p=337
Happy reading it's quite long but the USB artifacts diagram might help you.
USB Removal Date/Time
Re: USB Removal Date/Time
Posted: Tue Jan 29, 2013 12:02 pm
How would you recommend to the OP to use these artifacts in pursuit of their stated goals?
-
keydet89 - Senior Member
Re: USB Removal Date/Time
Posted: Wed Jan 30, 2013 1:30 am
How's that for weird timing?
I just finished watching the webinar on this forum that Jacky Fox did on USB registry artifacts, right hand side of the screen if you want to watch it.
She does mention or allude to the possibility that there may be some artifacts to show the removal of a USB device, and she talks about a way to link USB via serial number to .lnk files.
May be worth an email to get a copy of her dissertation or whitepapers she may have done.
I just finished watching the webinar on this forum that Jacky Fox did on USB registry artifacts, right hand side of the screen if you want to watch it.
She does mention or allude to the possibility that there may be some artifacts to show the removal of a USB device, and she talks about a way to link USB via serial number to .lnk files.
May be worth an email to get a copy of her dissertation or whitepapers she may have done.
-
Adam10541 - Senior Member
Re: USB Removal Date/Time
Posted: Wed Jan 30, 2013 8:19 am
- Adam10541
May be worth an email to get a copy of her dissertation or whitepapers she may have done.
That's not at all necessary...the dissertation and code were linked at the school site when I first watched her interview...
-
keydet89 - Senior Member
Re: USB Removal Date/Time
Posted: Wed Jan 30, 2013 2:34 pm
- Adam10541
May be worth an email to get a copy of her dissertation or whitepapers she may have done.
The dissertation and scripts are available here.
digitalfire.ucd.ie/?p=337
Happy reading it's quite long but the USB artifacts diagram might help you.
-
JackyFox - Member
Re: USB Removal Date/Time
Posted: Sun Feb 03, 2013 9:44 am
Thanks for the help and the link, folks.
Appreciate it.
-=Art=-
Appreciate it.
-=Art=-
-
4n6art - Senior Member
-
keydet89 - Senior Member