±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 36775
New Yesterday: 3 Visitors: 111

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

Xways Forensics - Attached usb devices

Forensic software discussion (commercial and open source/freeware). Strictly no advertising.
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

Dimi
Member
 

Xways Forensics - Attached usb devices

Post Posted: Jan 02, 18 21:15

Hi,
Hello,

Is there somebody who can tell me how i can best check which usb devices (thumbsticks, external hd) were connected to a windows computer system using xways forensics?

I guess i can find it in the registry files. But how do i have to check this?

thx  
 
  

minime2k9
Senior Member
 

Re: Xways Forensics - Attached usb devices

Post Posted: Jan 02, 18 21:42

Have a look at using the registry reports in X-Ways.
To do this, filter out all the relevant registry files, highlight them all, right click and select open.
Then from the menu select create report and select all the text files in the folder.  
 
  

keydet89
Senior Member
 

Re: Xways Forensics - Attached usb devices

Post Posted: Jan 02, 18 22:07

- minime2k9
Have a look at using the registry reports in X-Ways.


Depends on the version of Windows. In many instances, there are Windows Event Log files, or the AmCache.hve file, that provides much better (i.e., easier to correlate and understand) information.  
 
  

pbobby
Senior Member
 

Re: Xways Forensics - Attached usb devices

Post Posted: Jan 05, 18 00:19

- Dimi
Hi,
Hello,

Is there somebody who can tell me how i can best check which usb devices (thumbsticks, external hd) were connected to a windows computer system using xways forensics?

I guess i can find it in the registry files. But how do i have to check this?

thx


You 'view' the registry files - this opens the registry viewer. You then click the 'down arrow' in the upper left (not sure what this is called) and 'create report'. Pick the template.

This is how XWays does a regripper-like process against the registries.

Lol, this was already posted. Nm.
_________________
Don't get baited. 
 
  

Dimi
Member
 

Re: Xways Forensics - Attached usb devices

Post Posted: Jan 05, 18 20:07

Thx for the helpful advice  
 

Page 1 of 1