I've got in my gritty little paws a USB flash drive that was recovered from a group who participated in a rash of vehicle break-ins. Not sure if this is going to belong to the perps or one of their victims.
The USB flash drive is a 'Cruzer' which I run across all the time. This one however, someone actually took the time to set up the password.
I've attempted to just browse the drive, done a few other things, but to no avial. After failed attempts on the password, a flash screen is produced advising there is no way to 'reset' the password and that basically if you are the user and you forgot your password you are SOL. The only way to reset the password is to wipe the drive and start over which is obviously counter productive.
Anyone out there have any luck or ideas on accessing the data on this flash drive?
Thank You,
Bob
Which Sandisk Cruzer is it? Could be U3 or older kludged solution…
is there any files visible on the drive (runsecureaccess.exe or similar)?
This Cruzer has been around the block few times. Most of the identifying marks are on it are worn off other than the name 'Cruzer' itself.
As far as visibile files on the drive itself, from the root the following can be seen
autorun
Lauchpad (Zipped folder)
LaunchU3 (Executable)
Within the Luanchpad folder are the following files
cleanup (Application)
Launchpad Removal (Application)
Launchpad (Application)
Loading (Image)
Loading (HTML File)
8 help files in different languages
LPSecurityExtention (Application extension)
PelicanBusy (Image)
PelicanBusyPage (HTML File)
PelicanExtention.dll
PelicanExtention.dll.sig
SanDiskFormatExtention.dll
SanDskFormatExtention.dll.sig
U3AccessGrant (Application)
u3dapi10.dll
U3LauncherSetup (Installation executable)
version.dat
I've enabled the ability to see hidden folders and files to ensure I wasn't missing anything. I'm not seeing the file of which you speak (runsecureaccess.exe) on this particular flash drive.
Hope this points to some solution.
Ah, all the fun of a U3. You might want to take a look at
Also found a link to
I've attempted to just browse the drive, done a few other things, but to no avial.
Just out of curiosity, how were you able to browse the drive and see files listed? Did something change since your original post?
Nothing has changed with the USB. When the USB is initially plugged into the forensics machine, a pop up window requests the password.
I canceled that and simply browsed the contents of the USB drive. This is where I found the listed files.