USBSTOR contains details on the vendor and brand of the USB device connected, along with the serial number of the device (which can be used to match the mounted drive letter, user, and the first and last connected times of the device). Typically, for USB Mass Storage Devices, examiners need to collect details from multiple locations in order to analyze USB activity on a Windows PC. Most commonly, examiners will find valuable evidence in USB Mass Storage devices, but should still be familiar with other device types and how they are handled. The type of device will dictate which drivers have been installed on the system and how Windows handles the device. USB Mass Storage Device, Removable Storage, or MTP device). 7) and the type of USB device connected (ex. USB device analysis can vary depending on the operating system (ex. It can also help investigators understand how USB devices have been used on a given system, and possibly explain how a suspect might have used a USB device in the commission of a crime or incident. USB device history can be a great source of evidence when an examiner needs to determine if and why an external device was connected to a system. NTUSER.DAT/Software/Microsoft/Windows/CurrentVersion/Explorer/MountPoints2
0 kommentar(er)
