The last written time in the USBSTOR would that be the time that a particular usb device was last written to, or when it was first plugged in and that is when the registry entry was last written to. What I am trying to figure out is that if I plugged in a usb memory stick and I see its registry entry and I see the drivers and installation information in the setupapi.log, if I plug that same usb memory stick in the next day and say copy a file off of it onto the computer and then take it out, does the last written time in the registry change to the second date I plugged it in. When I looked at the setupapi for the second date there was nothing there showing that it was plugged in that second time. Thanks
Pronie, unless I am wrong, you will only see the time when the device was first plugged into the computer.
All of this is covered in "Windows Forensic Analysis", and has been covered in this forum as well.
There's just so many things that need to be addressed in the original post, I just don't have the time to write that much…sorry.
Side note
I just ordered the second edition which is available on Barnes & Noble.com
It is on Pre-Order -(
Book plugs aside, if you do some additional searching here in the forums you will most certainly find your answer. Useful search here
A shame there was time to plug your book, but no time to reference the threads immediately accessible that could help. Bleh, disregard, wrong side of bed today.
Nothing wrong with book plugs, particularly when the plug is for such a valuable resource…
It is on Pre-Order -(
I got mine in the mail a week ago. Barnes and Nobles
Nothing wrong with book plugs, particularly when the plug is for such a valuable resource…
lol
