Hello All,
I'm aware that there are many bits of information about a USB device that are written to a machine upon connection/disconnection of a USB device. What I'm wondering is if there is any information that goes the other way, writing info about the user/machine to a USB drive when it's plugged in? The drives in question are formatted as NTFS. Even if you can just point me in the right direction of a previous post/article that would be appreciated.
Thanks in advance!
Unless an application has been run from the USB device and creates and saves logs of its actions I can't think of any situation whereby a USB device would record details of what (Windows) box it has been plugged into. If I'm wrong, then I'm sure someone will point it out! 😉
The only thing I can think of, maybe, is that when it was plugged into the Windows computer - it may write a drive signature onto the USB device if it had not been in a Windows computer before.
Outside of something like that, I also have not heard of anything going to the USB drive automatically.
The only thing I can think of, maybe, is that when it was plugged into the Windows computer - it may write a drive signature onto the USB device if it had not been in a Windows computer before.
Naahh. (
MOST (read 99.99%) of USB sticks are formatted in factory as super-floppy. (NO disk signature)
MOST (read 99.99%) of USB hard disk are partitioned/formatted and accessed at least once by a NT based system.
The ONLY possibilities are
- a hard disk partitioned and formatted from Linux or DOS and NEVER connected before to a NT based system (quite improbable nowadays)
- a USB flash stick manually partitioned and formatted from Linux or DOS and NEVER connected before to a NT based system (quite improbable nowadays)
BUT since the mentioned devices volume(s) are formatted as NTFS this probability is 0.00%.
And anyway the MBR signature is pseudo-random and there is no way to "connect" it to a given machine. roll (without the actual machine, but that is the "normal" "other way round" info, vid/pid/serial and disk signature in Registry, etc.)
Outside of something like that, I also have not heard of anything going to the USB drive automatically.
Yep. )
jaclaz
Cool beans. Thanks for the confirmation, all.