Registry Files and Thumb Drive Image - Connection

pbobby · 2010-01-17T03:58:37Z

This is coming from one of the exercises in the DC3-2010 challenge.You have an image of a thumb drive - newly formatted.You have the system registry files, and an ntuser.dat file.Question How to show that the thumb drive was inserted in to the machine.Now before you go pulling all the standard USB stuff - remember, all you have is the image, and registry files.1. The iSerialNumber of the USB device is not present on the image, it's queried from firmware. So that was a dead end.2. I searched for the volume serial number in the registry but no joy.When a thumb drive is inserted in to a machine, and you query the live registry, there is an interesting entry under HKU..ExplorerMountPoints2CPCVolume{985b96c0-022c-11df-831e-000c29c3124b}DataIt contains what appears to be the volume boot record. But this data is not present when the registry files are copied from a deadbox.So, long story short, ?

Page 3 / 3 Prev

General (Technical, Procedural, Software, Hardware etc.)

Last Post by neddy 17 years ago

21 Posts

7 Users

0 Reactions

3,215 Views

RSS

neddy

(@neddy)

Estimable Member

Joined: 22 years ago

Posts: 182

28/03/2010 4:08 am

How about performing a toolmark examination? Oh, I forgot we dont appear to have the computer that we think the thumb drive was connected to!
It is an interesting scenario however, such exercises drive me nuts!

ReplyQuote

Page 3 / 3 Prev