±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 36783
New Yesterday: 2 Visitors: 141

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

U3 capable Usb

Discussion of forensic workstations, write blockers, bridges, adapters, disk duplicators, storage etc. Strictly no advertising of commercial products, please.
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

farrahyde
Member
 

U3 capable Usb

Post Posted: Oct 29, 06 02:50

Has anyone had experience with recovering data from a U3 capable usb drive?
can the programs within the U3 "program panel" work on other usb drives?
and, for future referance..has anyone noticed any regular changes made to a system in which this U3 capable usb drive is connected to? changes that are above and beyond what a Non U3 capable usb drive might make.
To make a long story short, U3 is a new technology to me and there's one here waiting for me to look at, any help would be appreciated.

thanks
Farrah
_________________
If you're gonna do it, do it well, or not at all. 
 
  

keydet89
Senior Member
 

Re: U3 capable Usb

Post Posted: Oct 29, 06 18:05

> Has anyone had experience with recovering data from a U3 capable usb drive?

I haven't. I've removed the U3 installation. I imaging, however that you would see two partitions...one CDFS, one FAT.

> can the programs within the U3 "program panel" work on other usb drives?

Sure, why wouldn't they? U3 isn't a hardware technology...it's software.

> and, for future referance..has anyone noticed any regular changes made
> to a system in which this U3 capable usb drive is connected to?

windowsir.blogspot.com...h-usb.html

www.forensicfocus.com/...&p=6513475

Anything in particular that you're looking for?

> U3 is a new technology to me and there's one here waiting for me to
> look at, any help would be appreciated.

Again, what specifically are you looking for? In short, the U3 "stuff" simply adds a CDFS partition to the thumb drive, in part so that the autorun capability of Windows will launch whatever's there...in this case, the U3 'desktop'. You'll see changes to the Registry as described in the blog entry, and for XP, you'll also see Prefetch entries (under the appropriate conditions, of course).

Hope that helps,

Harlan  
 
  

farrahyde
Member
 

Re: U3 capable Usb

Post Posted: Oct 29, 06 19:37

Again, what specifically are you looking for?

I must tie this usb stick to the host machine, without question.
TY for the link to the blog and registry information.

(under the appropriate conditions, of course).

Boy, that's a wide open statement. Wink

Thank you for the info.
Farrah
_________________
If you're gonna do it, do it well, or not at all. 
 
  

keydet89
Senior Member
 

Re: U3 capable Usb

Post Posted: Oct 30, 06 18:14

Well, you should have enough there to see if the thumb drive has a serial number, and that's what you need in order to tie the thumb drive to the host machine definitively.

Hope it works out.  
 
  

keydet89
Senior Member
 

Re: U3 capable Usb

Post Posted: Oct 30, 06 18:32

Nice web site, btw...  
 
  

farrahyde
Member
 

Re: U3 capable Usb

Post Posted: Nov 03, 06 23:47

Thanks for the web-pitch, and thanks again for the information.
I was able to link the usb drive to the host machine.
Gettin' busy writing that all important report.
_________________
If you're gonna do it, do it well, or not at all. 
 
  

ahoog
Member
 

Re: U3 capable Usb

Post Posted: Dec 17, 08 03:24

I know this is an old post but I see plenty of U3 devices out there and wrote up some forensic analysis details at:

chicago-ediscovery.com...drive.html

Hope this helps anyone who comes across this type of device.

-------------
Andrew Hoog
Chicago Electronic Discovery
chicago-ediscovery.com/  
 

Page 1 of 1