Home Articles The Hitchhiker’s Guide to USB Forensics

The Hitchhiker’s Guide to USB Forensics

0
1
19,343

If you are a digital forensic examiner, you must know, that clients very often ask to find out, which sensitive files were copied to USB thumb drives by disgruntled employees before they left the company. There are a lot of articles and guides on USB forensics on the Web, but most of them dealing with the flash drives and not the computer used by the employee. It seems quite strange to us as usually you have the computer’s drive or an image if the computer’s drive. So we have decided to write a USB forensics guide, which shows what to do if you have only computer’s image, and not the image of the USB thumb drive used for copying sensitive data.

Scenario

First, we created a Windows 10 virtual machine using Oracle Virtual Box. After we created three files with Windows Wordpad on the Desktop: Secrets.rtf, Confidential.rtf and Clients.rtf. We connected a USB thumb drive to our virtual machine, copied these files, and checked if they were copied correctly by opening them. Finally, we performed a normal shut down operation.

We used VDI file and Magnet AXIOM for its forensic examination. Thankfully, AXIOM supports these virtual machine files. For example, FTK Imager doesn’t display VDI contents correctly.

Examination

For testing purposes, we processed our VDI file with default settings. We are interested in operating system artifacts, so let’s go straight to corresponding category.

Figure 1. Operating system artifacts extracted by Magnet AXIOM

Let’s start from identifying connected USB thumb drives. As you can see on figure 1, AXIOM already extracted this information from Windows registry for us.

Figure 2. USB devices list extracted by Magnet AXIOM

We have only one interesting device (highlighted), let’s check artifact details – look at figure 3.

Figure 3. Interesting USB device details

So, suspicious device was last connected on 9/8/2017 at 8:52:57 AM (UTC), was assigned “E” drive letter and had 58E3D488 as volume serial number. Let’s go further and identify the files copied to this flash drive.

Let’s start from the Jump Lists. According to Magnet Artifacts Reference Guide, Jump lists are “quick lists of recent applications or files that a user launched”. We have filtered Linked Path column with “E:” keyword and got six artifacts, you can see them on figure 4.

Figure 4. Relevant Jump Lists artifacts

As you can see, now we have the evidence, that our sensitive files were transferred to an external drive with “E” letter assigned. But is it really that USB thumb drive? Yes! Look at the volume serial number, it matches the one extracted from USB devices artifacts!

But that’s not all! There are more artifacts! Now look at LNK files, we also filtered Linked Path column with “E:” keyword. Now we have 14 artifacts, let’s look at the details of one of them.

Figure 5. Information extracted from Secrets.lnk by Magnet AXIOM

Again, we see, that Secrets.rtf was copied to a flash drive with “E” drive letter and 58E3D488 volume serial number. Also, we see the date and time it was copied – 9/8/2017 8:53:24 AM (UTC).

Conclusion

As you can see, we can find digital evidence of sensitive data being copied to a USB thumb drive even without examination of this drive. Of course, it’s not always possible and depends on employee’s habits, but nevertheless, you should always try.

Happy forensicating!

About the authors

Oleg Skulkin, MCFE, ACE, is a DFIR enthusional (enthusiast + professional) and Windows Forensics Cookbook co-author.

Igor Mikhaylov, MCFE, ACE, OSFCE, is a digital forensic examiner with more than 20 years of experience and Mobile Forensics Cookbook author.

Load More Related Articles
Load More In Articles

No Comments

  1. Brendanrop

    April 16, 2019 at 3:06 pm

    Your comment is awaiting moderation.

    Fine tips. Cheers.
    http://viagrawithoutadoctormsn.com/
    how viagra affects glaucoma
    viagra for sale uk
    eli lily viagra patent
    [url=http://viagrawithoutadoctorsntx.com/]viagra 100mg[/url]

    Reply

  2. Brendanrop

    April 16, 2019 at 6:09 pm

    Your comment is awaiting moderation.

    This is nicely said! .
    http://viagrawithoutadoctormsn.com/
    side efects of viagra generic viagra drugs that interfere with viagra [url=http://viagrawithoutadoctorsntx.com/]viagra online[/url]
    fda schedule for viagra
    lawsuits on viagra
    does viagra counteract effects of propecia
    viagra effect men
    caught selling viagra
    generic viagra sold in chinatown nyc

    Reply

  3. Brendanrop

    April 16, 2019 at 6:13 pm

    Your comment is awaiting moderation.

    You reported it superbly!
    http://viagrapego.com/
    generic viagra levitra cialis viagra without a doctors prescription don’t mix viagra with steroids photo [url=http://viagrawithoutadoctorsntx.com/]viagra 100mg[/url]
    su viagra
    order viagra 1
    men’s health natural viagra
    provigil viagra interaction
    viagra visual change
    viagra dose online viagra dose url

    Reply

  4. Brendanrop

    April 16, 2019 at 6:27 pm

    Your comment is awaiting moderation.

    Great material. Thanks a lot.
    http://viagrawithoutadoctormsn.com/
    mixing viagra and cocaine viagra generic heart failure viagra [url=http://viagrapego.com/]generic viagra[/url]
    frequency of use of viagra
    viagra home office photo
    generic viagra buy sildenafil citrate
    buy viagra online
    viagra 9.99
    how long effects viagra

    Reply

  5. Brendanrop

    April 16, 2019 at 6:37 pm

    Your comment is awaiting moderation.

    Nicely put, Appreciate it.
    http://viagrawithoutadoctorsntx.com/
    direct sale of viagra to physicians buy viagra online online order viagra [url=http://viagrawithoutadoctorsntx.com/]buy viagra online[/url]
    order viagra consumer discount rx
    best place to buy viagra online
    is viagra for me
    su viagra
    viagra side effecs
    3generic meltabs viagra

    Reply

  6. Brendanrop

    April 16, 2019 at 7:35 pm

    Your comment is awaiting moderation.

    You said it adequately.!
    http://viagrapego.com/
    snopes viagra light switch viagra 100mg g postmessage viagra subject reply [url=http://viagrawithoutadoctorsntx.com/]viagra for women[/url]
    viagra effect
    viagra pill uk
    viagra dosage suhagra
    viagra for sale in gibralter
    reviews viagra
    viagra freebies

    Reply

  7. Brendanrop

    April 16, 2019 at 9:06 pm

    Your comment is awaiting moderation.

    Incredible plenty of excellent material.
    http://viagrawithoutadoctorsntx.com/
    contraindication epinephrine viagra viagra for sale uk natural viagra replacement [url=http://viagrawithoutadoctorsntx.com/]generic viagra[/url]
    free viagra powered by vbulletin
    difference between viagra 50mg and 100mg
    online viagra testosterone
    viagra sales uk
    viagra colitis
    viagra viagra search find cheap pages

    Reply

  8. Brendanrop

    April 16, 2019 at 10:15 pm

    Your comment is awaiting moderation.

    Amazing all kinds of wonderful knowledge.
    http://viagrawithoutadoctormsn.com/
    compare viagra levitra celias viagra for sale uk womans backlash to viagra [url=http://viagrawithoutadoctorsntx.com/]cheap viagra[/url]
    japanese viagra
    viagra funny photo
    2003 apcalis levitra market sales viagra
    viagra lawsuit pfizer
    cialis viagra differenze
    recreational viagra affects

    Reply

  9. Brendanrop

    April 17, 2019 at 12:02 am

  10. Brendanrop

    April 17, 2019 at 12:17 am

  11. Brendanrop

    April 17, 2019 at 12:27 am

    Your comment is awaiting moderation.

    Wow loads of wonderful info.
    http://viagrawithoutadoctormsn.com/
    coleman 2000 viagra elite buy viagra hasan arrested viagra [url=http://viagrapego.com/]generic viagra 100mg[/url]
    viagra injections
    scams vignor herbal viagra
    viagra drink recipe
    rx viagra toledo
    how long viagra lasts
    viagra effekter biverkningar

    Reply

  12. Brendanrop

    April 17, 2019 at 1:27 am

    Your comment is awaiting moderation.

    Many thanks, Great stuff!
    http://viagrapego.com/
    online viagra pills viagra online is cialis as good as viagra [url=http://viagrawithoutadoctormsn.com/]viagra for women[/url]
    canadian mail order viagra
    do woman use viagra
    where can u sample viagra free
    recreational viagra use
    natual alternative to viagra
    viagra without prescription sample

    Reply

  13. Kennethtof

    April 17, 2019 at 4:09 am

    Your comment is awaiting moderation.

    Incredible lots of good info.
    http://viagrapego.com/
    viagra effect women generic viagra 100mg viagra enema [url=http://viagrawithoutadoctorsntx.com/]viagra online[/url]
    what is viagra used for
    viagra effective for women
    herbal equivalent to viagra
    viagra ergogenic use by ron lebard
    edinburgh find viagra search sites
    find viagra edinburgh ago articleid good

    Reply

  14. Kennethtof

    April 17, 2019 at 5:06 am

    Your comment is awaiting moderation.

    Awesome info. Cheers.
    http://viagrawithoutadoctormsn.com/
    how does viagra affect blood pressure viagra without a doctors prescription viagra ripoffs [url=http://viagrawithoutadoctorsntx.com/]generic viagra[/url]
    viagra ok scuba diving nitrogen
    generic viagra blue pill 25mg
    generic sildenafil viagra
    viagra crooks
    erowid zoloft viagra
    how safe is viagra from india

    Reply

  15. Kennethtof

    April 17, 2019 at 5:57 am

    Your comment is awaiting moderation.

    Fantastic knowledge. Kudos!
    http://viagrawithoutadoctorsntx.com/
    wall mart drugs viagra buy generic viagra viagra and coke [url=http://viagrawithoutadoctorsntx.com/]viagra for women[/url]
    health risks viagra
    viagra natural alternatives
    viagra buy india
    viagra for women germany
    viagra tribulus
    the little red pill like viagra

    Reply

  16. Kennethtof

    April 17, 2019 at 6:01 am

    Your comment is awaiting moderation.

    Very good material. Thank you.
    http://viagrapego.com/
    pages edinburgh search viagra free viagra without a doctors prescription viagra nation [url=http://viagrawithoutadoctorsntx.com/]buy generic viagra[/url]
    vegtable viagra
    acupuncture oct ivf women viagra
    ph lipaphen viagra women
    provigro vs viagra
    healthy loss viagra weight
    viagra cheap no prescrip

    Reply

  17. Kennethtof

    April 17, 2019 at 6:26 am

    Your comment is awaiting moderation.

    Lovely forum posts. Thanks!
    http://viagrawithoutadoctormsn.com/
    recreational viagra use sex stories viagra for women wholesale .60 viagra [url=http://viagrapego.com/]buy viagra[/url]
    free viagra 2009 jelsoft enterprises ltd
    viagra imitations
    generic viagra houston tx
    other viagra
    comparison viagra regalis levitra
    viagra research article

    Reply

  18. Kennethtof

    April 17, 2019 at 9:03 am

    Your comment is awaiting moderation.

    You made the point!
    http://viagrapego.com/
    viagra history viagra without a doctors prescription viagra movie [url=http://viagrapego.com/]viagra 100mg[/url]
    lloyds internet sales viagra
    alternative viagra
    viagra heart disease
    longterm viagra use
    viagra boyfriend story
    viagra treatment hape

    Reply

  19. Kennethtof

    April 17, 2019 at 10:14 am

    Your comment is awaiting moderation.

    Seriously plenty of great data.
    http://viagrawithoutadoctormsn.com/
    u s viagra by mail buy viagra nude viagra video [url=http://viagrapego.com/]generic viagra 100mg[/url]
    duct tape viagra
    louisville commercial viagra
    viagra purchase without perscription us pharmacy
    most effective way to use viagra
    hard erections without viagra
    herbal viagra substitute

    Reply

  20. Kennethtof

    April 17, 2019 at 11:12 am

    Your comment is awaiting moderation.

    Appreciate it, Ample knowledge!

    http://viagrapego.com/
    viagra pregnancy fetus viagra without a doctor prescription watermelon has same effects as viagra [url=http://viagrawithoutadoctorsntx.com/]generic viagra 100mg[/url]
    taking viagra on a full stomach
    canadian viagra prices
    pumpkin pie vs viagra
    levitra viagra vs
    viagra portland oregon vancouver washington
    viagra creme

    Reply

  21. Kennethtof

    April 17, 2019 at 12:09 pm

    Your comment is awaiting moderation.

    You’ve made your position very nicely..
    http://viagrawithoutadoctorsntx.com/
    pfizer viagra free trial viagra for women viagra online buy [url=http://viagrawithoutadoctorsntx.com/]cheap viagra[/url]
    viagra and blood disorders
    viagra alternive
    womens viagra tv
    viagra boring pages edinburgh search sites
    viagra and regaine
    reviews for viagra cialis and levitra

    Reply

  22. Kennethtof

    April 17, 2019 at 12:24 pm

    Your comment is awaiting moderation.

    Useful facts. Kudos!
    http://viagrapego.com/
    what is best viagra cialis buy viagra online 1cialis levitra sales viagra [url=http://viagrawithoutadoctormsn.com/]buy generic viagra[/url]
    viagra and hemmroids
    viagra canada without prescription
    viagra and high blood pressure
    viva viagra slogan
    generic viagra in india
    charles viagra search pages edinburgh

    Reply

  23. Kennethtof

    April 17, 2019 at 12:35 pm

    Your comment is awaiting moderation.

    You actually expressed this fantastically.
    http://viagrawithoutadoctormsn.com/
    viagra and amiben online generic viagra 100mg generic viagra real [url=http://viagrawithoutadoctormsn.com/]viagra online[/url]
    distribution of viagra
    slogan’s for viagra joke
    viagra hepatitis
    c-ring viagra
    buy cheap uk viagra
    viagra and health reform

    Reply

  24. Kennethtof

    April 17, 2019 at 1:38 pm

    Your comment is awaiting moderation.

    This is nicely put! .
    http://viagrawithoutadoctormsn.com/
    spiked drinks viagra viagra 100mg viagra options [url=http://viagrawithoutadoctormsn.com/]buy generic viagra[/url]
    kick ass viagra cocktail
    viagra and trazadone
    xenical viagra zyban proscar
    viagra propecia celebrex
    viagra by mail approval online
    cozaar and viagra

    Reply

  25. Kennethtof

    April 17, 2019 at 3:15 pm

    Your comment is awaiting moderation.

    Effectively expressed certainly. !
    http://viagrawithoutadoctormsn.com/
    natural testosterone viagra viagra without a doctors prescription cirrhosis frequency viagra [url=http://viagrawithoutadoctorsntx.com/]viagra generic[/url]
    cialis viagra cost comparasin
    does midicare pay for viagra
    works viagra
    viagra citalopram
    generic viagra super active canada
    pablo francisco viagra

    Reply

  26. Kennethtof

    April 17, 2019 at 5:29 pm

    Your comment is awaiting moderation.

    Kudos, Very good stuff!
    http://viagrawithoutadoctormsn.com/
    when viagra dosent work generic viagra 100mg viagra and jet lag [url=http://viagrapego.com/]generic viagra 100mg[/url]
    viagra erection lenght
    order canada super viagra
    viagra substitutes
    buying viagra over the counter
    viagra no presrciption
    taking viagra and tagamet

    Reply

  27. Kennethtof

    April 17, 2019 at 6:23 pm

    Your comment is awaiting moderation.

    Seriously loads of amazing knowledge.
    http://viagrapego.com/
    buy viagra from canada or mexico viagra without a doctor prescription viagra treatment for crohn’s [url=http://viagrawithoutadoctormsn.com/]buy viagra[/url]
    levitra viagra v cialis
    what if a woman took viagra
    can a young man take viagra
    viagra indigestion
    is cialis as good as viagra
    jama viagra

    Reply

  28. Kennethtof

    April 17, 2019 at 6:27 pm

    Your comment is awaiting moderation.

    Nicely put. Thanks!
    http://viagrapego.com/
    viagra trials private instruction viagra online first time i take a viagra [url=http://viagrawithoutadoctorsntx.com/]viagra for sale uk[/url]
    what can make viagra stronger
    viagra and ph
    buy cheap viagra
    viagra discount 800 number customer service
    viagra sex video free
    viagra in new zeland

    Reply

  29. Kennethtof

    April 17, 2019 at 6:43 pm

    Your comment is awaiting moderation.

    You revealed this really well!
    http://viagrapego.com/
    low cost alternatives and viagra viagra generic sex slave viagra use [url=http://viagrapego.com/]viagra for sale uk[/url]
    generic viagra wholesale fast delivery
    voto eletronico viagra para eleitores passivos
    open label viagra study comment
    no orgasm with viagra
    buy viagra canada warning
    topic 3642 viagra

    Reply

  30. Kennethtof

    April 17, 2019 at 6:54 pm

    Your comment is awaiting moderation.

    Info effectively utilized!.
    http://viagrawithoutadoctorsntx.com/
    how to make homemade viagra viagra for sale uk viagra and other erectile medicines [url=http://viagrawithoutadoctormsn.com/]buy generic viagra[/url]
    generic viagra and india
    trusted generics viagra sildenafil
    cheap canadian generic viagra
    viagra ceapest prices
    caverta generic veega viagra
    treating viagra indigestion

    Reply

  31. Kennethtof

    April 17, 2019 at 9:39 pm

    Your comment is awaiting moderation.

    Thanks! Quite a lot of content!

    http://viagrapego.com/
    viagra healing buy generic viagra alternative presciption medication to viagra [url=http://viagrapego.com/]buy generic viagra[/url]
    paroxetine viagra
    viagra find edinburgh site born
    oragel viagra sex
    viagra voorschrift
    compare cilalis and viagra
    generic viagra generic meltabs viagra

    Reply

  32. Kennethtof

    April 17, 2019 at 10:55 pm

    Your comment is awaiting moderation.

    Whoa loads of fantastic tips.
    http://viagrawithoutadoctormsn.com/
    ayurvedic viagra viagra online sex message boards viagra [url=http://viagrawithoutadoctormsn.com/]buy viagra[/url]
    cialis comparison viagra
    viagra erektile dysfunktion diagnostik
    viagra user photos
    where to purchase viagra cheap
    viagra health effects
    viagra news computer find sites edinburgh

    Reply

  33. Kennethtof

    April 18, 2019 at 12:52 am

    Your comment is awaiting moderation.

    Thank you. A lot of material!

    http://viagrapego.com/
    novocaine viagra buy viagra online edinburgh uk viagra site born find [url=http://viagrapego.com/]viagra for women[/url]
    reasons why viagra would be ineffective
    viagra for impotence
    foods that act like viagra
    is cialis beter dan viagra
    attack heart viagra
    viagra sore wife

    Reply

  34. Kennethtof

    April 18, 2019 at 12:56 am

    Your comment is awaiting moderation.

    Truly many of helpful information!
    http://viagrawithoutadoctormsn.com/
    viagra and hydrochlorothiazide viagra without a doctors prescription viagra alter [url=http://viagrawithoutadoctorsntx.com/]generic viagra[/url]
    viagra half price
    viagra without prescription uk pharmacy
    file viewtopic t 144 viagra
    order forms for buying viagra
    buy viagra in london england
    viagra halicyte

    Reply

  35. Kennethtof

    April 18, 2019 at 1:12 am

    Your comment is awaiting moderation.

    Fine material. Many thanks!
    http://viagrapego.com/
    target viagra viagra for women rush illegal viagra [url=http://viagrawithoutadoctorsntx.com/]viagra generic[/url]
    viagra 200mg
    l arginine viagra
    safe viagra dose
    generic viagra real
    viagra boots
    seduced boys viagra

    Reply

  36. Kennethtof

    April 18, 2019 at 1:24 am

    Your comment is awaiting moderation.

    Fantastic content. Thanks a lot!
    http://viagrapego.com/
    viagra from uk viagra 100mg viagra frequency of priapism [url=http://viagrapego.com/]generic viagra[/url]
    viagra prostate removal
    safety of buying viagra on line
    edinburgh uk pages viagra find search
    viagra cut in thirds
    dallas medical examination costs viagra
    viagra sizes

    Reply

  37. Kennethtof

    April 18, 2019 at 2:30 am

    Your comment is awaiting moderation.

    Seriously a lot of helpful material.
    http://viagrapego.com/
    does lorazepam inhibit viagra viagra online viagra intercourse porn photos [url=http://viagrawithoutadoctorsntx.com/]generic viagra online[/url]
    viagra l477
    viagra online overnight next day shipping
    maximum dosage of viagra
    viagra use for enlarged heart 2011
    natural herbs used as viagra
    viagra eye problems

    Reply

  38. Kennethtof

    April 18, 2019 at 4:14 am

Leave a Reply

Your email address will not be published. Required fields are marked *