Hi,
Hello,
Is there somebody who can tell me how i can best check which usb devices (thumbsticks, external hd) were connected to a windows computer system using xways forensics?
I guess i can find it in the registry files. But how do i have to check this?
thx
Have a look at using the registry reports in X-Ways.
To do this, filter out all the relevant registry files, highlight them all, right click and select open.
Then from the menu select create report and select all the text files in the folder.
Have a look at using the registry reports in X-Ways.
Depends on the version of Windows. In many instances, there are Windows Event Log files, or the AmCache.hve file, that provides much better (i.e., easier to correlate and understand) information.
Hi,
Hello,Is there somebody who can tell me how i can best check which usb devices (thumbsticks, external hd) were connected to a windows computer system using xways forensics?
I guess i can find it in the registry files. But how do i have to check this?
thx
You 'view' the registry files - this opens the registry viewer. You then click the 'down arrow' in the upper left (not sure what this is called) and 'create report'. Pick the template.
This is how XWays does a regripper-like process against the registries.
Lol, this was already posted. Nm.
Thx for the helpful advice