If you have a mobile internet dongle, what data can be acquired from it with forensic examination? Can the websites it was used to connect to be viewed?
Interesting question, not something I've even considered before.
Just for giggles I grabbed my work one and threw it onto Xways for a quick look. Nothing identified as internet related before or after a data carve, just a few pictures and the install software.
Hardly a definitive answer but I suspect that nothing is written to the USB dongle during use, it would all be written to the hard drive in the normal fashion.
Of course I could only add the logical partition in this particular case as the dongle identifies as a CD with Windows and wants to install the software. If there was a way to access the physical device there may be more interesting artifacts contained within.
Just for giggles I grabbed my work one and threw it onto Xways for a quick look. Nothing identified as internet related before or after a data carve, just a few pictures and the install software.
That was probably the USB mass storage device part. It not likely to contain anything but initial setup software and documentation.
The dongle need not be an USB mass storage device only, though. There could be additional devices, some of which may allow information storage. However, that requires much closer inspection.
Tools such as USBdeview (Windows) can be used to identify the device type. Additional tools may allow enumeration of interfaces and endpoints.
A fairly common situations is to have one communication devcie and one CDC control device. Wifi adapters and other communication adapters often have these.
Think of multi-purpose devices such as a scanner/fax/printer connected by USB – it is likely to have one device (or perhaps interface) for each of the major areas of functionality. A label printer I have has one mass storage device, where the basic label-printing software can be found, and one vendor-specific device, which I presume is the basic label printer.
Same might be true for these dongles.
Well most (please read as ALL) internet dongles are "combo devices", one is essentially a mobile modem (rather a terminal adapter as nothing is modulated or demodulated or in some cases they are a "router") but they host also a "CD like device" (which is normally accessible as if it was the "CD like" device that can be had on almost any modern USB sticks or in the U3 kind of devices (if anyone remembers them) and *somewhere* a R/W area where the settings (that you normally change through the http/web interface or through the "dashboard", see below) are stored.
To all effects when you connect it to a Windows it is a CD-like device and through the default mass storage driver you can only access the CD part (which obviously is Read Only) and a communication device, usually mapped to a (virtual) COM port if it is a TA, example
http//
For Huawei devices (very common) the program is called a "dashboard" and there are hacks/mods/whatever to change it as usually these keys are issued by a mobile operator that tend to lock down some features to their own mobile net.
There are also real "mini-routers" (that provide a "local Wi-Fi zone") but in this case the "router" device is not particularly different from a common DSL TA or router, all you can find in it are the settings you chose and saved (like IP address, IP range, DHCP settings, DNS,etc. of course depending on the specific key/stick).
Some of these USB thingies (example)
http//
also provide a slot for a microSD, but that will appear just like a (further) mass-storage device, i.e. a handy way to have in the same device some space to save (voluntarily and manually) what you access from the internet or to copy some files from the computer.
From a forensic viewpoint the only info that might be useful is the connection times and the amount of bytes transferred, which are usually viewable through the dashboard or web interface in a "summed up" way but that possibly may come from more granular data that could be *somehow* found/accessed.
Also some keys do behave like a "normal" phone regarding SMS that can be sent and received, though most probably it is the actual SIM that is used to store them.
jaclaz