Belka,
Thanks for the reference.
Well, the original is (slightly) more misguiding
Because USB flash drives report themselves as removable, they cannot be indexed.
USB sticks come (from factory) in 99.99% set as removable and formatted as "superfloppy" (usually in FAT32).
BUT it is possible (and actually done very often) to place a MBR on it (and optionally more than one partition/volume).
Windows will still see the device as removable and access only first volume on it (to be picky the partition which is in first entry of the MBR partitition table)
So quite a few people (in order to make "bootable sticks" for recovery etc. with multiple OS) change the state of the USB stick.
This can be done in two ways
- "flipping the removable bit", i.e. using a Manufacturer Tool to let the USB stick be seen as "Fixed"
- install in the Windows a "Filter driver" that can be either installed as "generic" (all USB removable devices) or "for a given device only" <- for the record the first of such drivers was developed by Hitachi to allow managing the IBM/Hitachi MicroDrive
So, it is much more common that a USB stick IS "Removable", but still it is very possible that a USB stick is "Fixed" (and thus possibly automatically indexed)
As a side note, and additionally, though it is of course the most normal case is that a USB stick is automounted to a drive letter at connection, if it is instead mounted to a mountpoint residing on a hard disk it should be indexed as well. ?
jaclaz
Minime
Have you tested how quickly the data in the EDB file is cleaned up/deleted when USB devices are disconnected from the machine?
Assuming a Windows OS, you won't be able to find a log of if or what's been copied. The only history information available in Windows is a fact that a certain USB device (with its unique ID) was connected at a certain time. /
Not necessarily true,although not a log, on Windows 7 computers the Windows.edb file may have indexed the pen drive and would show the filenames on the drive as well as the first time they were 'spotted' by windows.
Esedb viewer is a good tool for viewing the Windows.edb, although you may need to repair the database first. Can be done using esentutl.exe which is on Windows 7 system.
You would need to extract to MSS file and MSS00x files from the directory with windows.edb in as well as windows.edb fileCommand line is esentutl.exe /r mss -d (i think)