Notifications

Clear all

USB Removal Date/Time

4n6art · 2013-01-25T10:02:37Z

Hi AllHappy New Year D (dang - time flies it's almost Jan end)Is there a way to tell when a USB device (in this case a thumbdrive) was *removed* from a laptop? We have the date it was first inserted. User claims they inserted and removed it immediately. Is there a way to tell when it was removed OR how long it was plugged in for?Also, just want to double check….Unless data on the usb device is viewed or opened we would not see any mention of those files on the suspect machine (assuming that data has never been viewed on that machine before) - is that correct? If a user were to view thumbdrive in Explorer, R+Click the files and copy and paste them to a server drive, there would be no evidence of that being done. Are my assumptions correct?I believe the OS is WinXP.Thanks for any help.-=Art=-

Page 2 / 2 Prev

General (Technical, Procedural, Software, Hardware etc.)

Last Post by keydet89 12 years ago

13 Posts

6 Users

0 Reactions

1,949 Views

RSS

JackyFox

(@jackyfox)

Eminent Member

Joined: 15 years ago

Posts: 20

31/01/2013 1:34 am

May be worth an email to get a copy of her dissertation or whitepapers she may have done.

The dissertation and scripts are available here.

http//digitalfire.ucd.ie/?p=337

Happy reading it's quite long but the USB artifacts diagram might help you.

ReplyQuote

4n6art

(@4n6art)

Reputable Member

Joined: 18 years ago

Posts: 208

Topic starter 03/02/2013 8:44 pm

Thanks for the help and the link, folks.
Appreciate it.
-=Art=-

ReplyQuote

keydet89

(@keydet89)

Famed Member

Joined: 21 years ago

Posts: 3568

10/02/2013 7:09 pm

So…what did you find out?

ReplyQuote

Page 2 / 2 Prev

8 Forums
15.7 K Topics
92.3 K Posts
280 Online
41.1 K Members

Forum Icons: Forum contains no unread posts Forum contains unread posts

Topic Icons: Not Replied Replied Active Hot Sticky Unapproved Solved Private Closed