Is there a program out there that can live on a flash memory stick and when inserted on a target machine can download files of a given type to this same memory stick?
Need to check out a system but have limited access.
Cheers
Automatically? No. Thumb drives, by default, do not have autorun capability. However, if you have one of those U3 devices where the first couple of MB are a CDFS partition, and you knew how to install your own utilities, then sure, you could do that. But what you're asking…there's stuff that you can install on the PC to copy files from the thumb drive, but the other way around? I can't say that I've heard of any…
If you like, though, I'm sure I could write one…since you're posting under "commercial software", how much would you be willing to pay for such an application?
If you like, though, I'm sure I could write one…since you're posting under "commercial software", how much would you be willing to pay for such an application?
lol well I have a rule!
As little as possible!
However in all seriousness it would depend how go it worked.
I can see other uses for this not just this one investigation.
I have a 1GB stick.
Over to you?
> As little as possible!
Okay, let me see if I understand this…
You have a need, and so far, you have not been able to find a tool or utility that will meet that need. You evidently do not have programming skills, so you would need someone to develop a tool for you, and so far, no one else has chimed in requesting such functionality (ie, this is a specialized tool that, so far, only you have use for).
How much of a donation are you willing to make for something like this?
As I see it, once the application is initiated, it would have to check the local drive (thumb drive) for available space, and then check the system that it's been plugged into for fixed hard drives (unless you want it to also include network shares, but things can really get out of control there). Once it has a list of local fixed drives, it starts looking for files of a particular type, and once it finds them, it copies them, keeping track of the amount of space used.
Now, getting it to run automatically is another issue. You can get a U3-enabled device and create a custom ISO for installation into the CDFS partition; that custom ISO would include the above application. Of course, the complexity of the application would then go up a bit, but not by much.
So there it is. You're asking for a lot of work to be done for you. From what I can see, you can do it yourself, or you can provide a donation or incentive for someone else to do it for you.
Just a thought…
> As little as possible!
So there it is. You're asking for a lot of work to be done for you. From what I can see, you can do it yourself, or you can provide a donation or incentive for someone else to do it for you.
Just a thought…
A thought to your thought.
Lets not have it automated then.
What if you plug it in and it runs on your command a search for a specific file type (bmp, jpg, doc) or group of file types.
Then copies them to the mem stick.
Does this make it more simple?
Like you say only I need it now, but I wonder in the wider world if many others would find this helpful?
Could be used for a back up, quick grab of files before going out etc.
So it may have a commercial value after all.
What if I donated my time to helping test it with the developer and then let them keep all the rights to it?
Or, like you say I could try building it myself.
My original question was "is there" if the answers no and its going to be expensive to make then its time for me to try another tac.
But thanks for your input all the same -)
Mike
> Does this make it more simple?
Sure does…it's called a "batch file". Just create a batch file that does "dir /s" and tokenizes the files that it gets. Have it check the file extension for what you're looking for and if it finds it, use xcopy to copy the file to the thumb drive.
> but I wonder in the wider world if many others would find this helpful?
Sure, but for what? Given the requirement for speed and stealth, one can only assume criminal intent behind it. After all, in a corporate environment, for example, someone with legitimate access can get that same info via the network.
Someone with a legit need for something like this need only select the files in Explorer, right-click, and choose "send to…", or use any number of alternative methods.
> What if I donated my time to helping test it with the developer and then let them keep all the rights to it?
Hhhhmm…I doubt you'll get many offers for that. After all, how much testing is really required for something like this? And any developer who writes something like this is probably going to keep the "rights" anyway. In the US, all that's required for a copyright is for someone to put their name on whatever they created.
Ok thanks D I'll look up batch files and see if I can make it work ?
No criminal intent here can assure you! simply need to check a pc without causing embarrassment if there is no need.
Can't go into detail.
Hi
Well I have gone down the xcopy route!
Example
xcopy "C/*.doc"/s/h "D/grabs/doc" /I /F
Cheers
Mike
I know of a tool in development, that resides on a usb stick (a U3 stick but the U3 features are not active.) The app will index, dedup, extract, and make forensic quality copies (not bit for bit.) The only foot print on the target machine should be a registry entry that a usb drive was attached.
The amount of data extracted in the index is impressive and depending on the type of data can include over 30 fields including
"FileName","Path","Extension","FileCategory","FileType","TypeDescription",
"FileHash","Drive","FileSystem","FileSize","SizeOnDisk","DateCreated",
"DateLastAccessed","DateLastModified","IsProtected","IsCorrupted",
"SupportsTextExtraction","SupportsFileExtraction",
"HasOleEmbeddedObjects","HasOleEmbeddedFiles",
"HasAttachments","HasAlternateStreams","IsArchive","IsCompressed",
"IsDevice","IsDirectory","IsEncrypted","IsHidden","IsNormal",
"IsNotContentIndexed","IsOffline","IsReadOnly","IsReparsePoint",
"IsSparseFile","IsSystem","IsTemporary","AlternateStreamCount",
"AlternateStreamNames","AlternateStreamSizes",
"AlternateStreamSizesOnDisk","FullName","DuplicateTag","ItemIndex"
There are several versions of the usb app. One for .net capable systems and one for non .net systems.
The product works but is still in beta state. If there are any really technical forensic guys interested in beta testing the app, I am sure the developer would appreciate the help. If you are interested in contacting the developer go to litquest.com.
The developer has desktop install versions of the app available also.
By the way, I neither work for nor receive any compensation from litquest for this comment.
thanks,
j
litigation support and forensics