same usb at the sam...
 
Notifications
Clear all

same usb at the same time !!  

Page 2 / 2
  RSS
jaclaz
(@jaclaz)
Community Legend

And, AGAIN, you are mixing what happened on the SAME date
1) early in the morning up to 830 AM
2) around lunch time, i.e. from 100 to 200 PM

The "MicrosoftWindowsSystemRestoreSR" actions are automated, it is part of the "System Restore" scheduled task.

At that time a VSS (Volume Shadow) Copy was seemingly made, and somehow the process did reset a number of keys related to USB (and non-USB devices).

As well anything marked "WindowsReadyBoost" is "normal" automated activities of the OS.

From what you posted human interaction with the PC was only around lunch time, where some USB storage devices were definitely connected.

BTW the reference to the .JPG on the I volume makes me think that maybe that is the drive letter assigned to a volume on the attached USB disk should allow you to retrieve the disk information from MountedDevices.

jaclaz

ReplyQuote
Posted : 25/06/2018 11:08 am
qassam22222
(@qassam22222)
Active Member

And, AGAIN, you are mixing what happened on the SAME date
1) early in the morning up to 830 AM
2) around lunch time, i.e. from 100 to 200 PM

The "MicrosoftWindowsSystemRestoreSR" actions are automated, it is part of the "System Restore" scheduled task.

At that time a VSS (Volume Shadow) Copy was seemingly made, and somehow the process did reset a number of keys related to USB (and non-USB devices).

As well anything marked "WindowsReadyBoost" is "normal" automated activities of the OS.

From what you posted human interaction with the PC was only around lunch time, where some USB storage devices were definitely connected.

BTW the reference to the .JPG on the I volume makes me think that maybe that is the drive letter assigned to a volume on the attached USB disk should allow you to retrieve the disk information from MountedDevices.

jaclaz

thank u very much bro for helping ….
so i will rely on the logs that show that there is a user interaction on the pc in the court because they said that computer was turned off at that date )

i think its time to give the police an order to bring some one )

ReplyQuote
Posted : 25/06/2018 11:47 am
Page 2 / 2
Share: