Join Us!

Notifications
Clear all

U3 capable Usb  

  RSS
farrahyde
(@farrahyde)
New Member

Has anyone had experience with recovering data from a U3 capable usb drive?
can the programs within the U3 "program panel" work on other usb drives?
and, for future referance..has anyone noticed any regular changes made to a system in which this U3 capable usb drive is connected to? changes that are above and beyond what a Non U3 capable usb drive might make.
To make a long story short, U3 is a new technology to me and there's one here waiting for me to look at, any help would be appreciated.

thanks
Farrah

Quote
Posted : 29/10/2006 1:50 am
keydet89
(@keydet89)
Community Legend

> Has anyone had experience with recovering data from a U3 capable usb drive?

I haven't. I've removed the U3 installation. I imaging, however that you would see two partitions…one CDFS, one FAT.

> can the programs within the U3 "program panel" work on other usb drives?

Sure, why wouldn't they? U3 isn't a hardware technology…it's software.

> and, for future referance..has anyone noticed any regular changes made
> to a system in which this U3 capable usb drive is connected to?

http//windowsir.blogspot.com/2006/09/something-old-something-newwith-usb.html

http//www.forensicfocus.com/index.php?name=Forums&file=viewtopic&p=6513475

Anything in particular that you're looking for?

> U3 is a new technology to me and there's one here waiting for me to
> look at, any help would be appreciated.

Again, what specifically are you looking for? In short, the U3 "stuff" simply adds a CDFS partition to the thumb drive, in part so that the autorun capability of Windows will launch whatever's there…in this case, the U3 'desktop'. You'll see changes to the Registry as described in the blog entry, and for XP, you'll also see Prefetch entries (under the appropriate conditions, of course).

Hope that helps,

Harlan

ReplyQuote
Posted : 29/10/2006 5:05 pm
farrahyde
(@farrahyde)
New Member

Again, what specifically are you looking for?

I must tie this usb stick to the host machine, without question.
TY for the link to the blog and registry information.

(under the appropriate conditions, of course).

Boy, that's a wide open statement. wink

Thank you for the info.
Farrah

ReplyQuote
Posted : 29/10/2006 6:37 pm
keydet89
(@keydet89)
Community Legend

Well, you should have enough there to see if the thumb drive has a serial number, and that's what you need in order to tie the thumb drive to the host machine definitively.

Hope it works out.

ReplyQuote
Posted : 30/10/2006 5:14 pm
keydet89
(@keydet89)
Community Legend

Nice web site, btw…

ReplyQuote
Posted : 30/10/2006 5:32 pm
farrahyde
(@farrahyde)
New Member

Thanks for the web-pitch, and thanks again for the information.
I was able to link the usb drive to the host machine.
Gettin' busy writing that all important report.

ReplyQuote
Posted : 03/11/2006 10:47 pm
ahoog
(@ahoog)
Junior Member

I know this is an old post but I see plenty of U3 devices out there and wrote up some forensic analysis details at

http//chicago-ediscovery.com/computer-forensic-howtos/forensic-acquisition-analysis-u3-usb-drive.html

Hope this helps anyone who comes across this type of device.

————-
Andrew Hoog
Chicago Electronic Discovery
http//chicago-ediscovery.com/

ReplyQuote
Posted : 17/12/2008 2:24 am
Share: