Home Articles The Hitchhiker’s Guide to USB Forensics

The Hitchhiker’s Guide to USB Forensics

0
1
20,611

If you are a digital forensic examiner, you must know, that clients very often ask to find out, which sensitive files were copied to USB thumb drives by disgruntled employees before they left the company. There are a lot of articles and guides on USB forensics on the Web, but most of them dealing with the flash drives and not the computer used by the employee. It seems quite strange to us as usually you have the computer’s drive or an image if the computer’s drive. So we have decided to write a USB forensics guide, which shows what to do if you have only computer’s image, and not the image of the USB thumb drive used for copying sensitive data.

Scenario

First, we created a Windows 10 virtual machine using Oracle Virtual Box. After we created three files with Windows Wordpad on the Desktop: Secrets.rtf, Confidential.rtf and Clients.rtf. We connected a USB thumb drive to our virtual machine, copied these files, and checked if they were copied correctly by opening them. Finally, we performed a normal shut down operation.

We used VDI file and Magnet AXIOM for its forensic examination. Thankfully, AXIOM supports these virtual machine files. For example, FTK Imager doesn’t display VDI contents correctly.

Examination

For testing purposes, we processed our VDI file with default settings. We are interested in operating system artifacts, so let’s go straight to corresponding category.

Figure 1. Operating system artifacts extracted by Magnet AXIOM

Let’s start from identifying connected USB thumb drives. As you can see on figure 1, AXIOM already extracted this information from Windows registry for us.

Figure 2. USB devices list extracted by Magnet AXIOM

We have only one interesting device (highlighted), let’s check artifact details – look at figure 3.

Figure 3. Interesting USB device details

So, suspicious device was last connected on 9/8/2017 at 8:52:57 AM (UTC), was assigned “E” drive letter and had 58E3D488 as volume serial number. Let’s go further and identify the files copied to this flash drive.

Let’s start from the Jump Lists. According to Magnet Artifacts Reference Guide, Jump lists are “quick lists of recent applications or files that a user launched”. We have filtered Linked Path column with “E:” keyword and got six artifacts, you can see them on figure 4.

Figure 4. Relevant Jump Lists artifacts

As you can see, now we have the evidence, that our sensitive files were transferred to an external drive with “E” letter assigned. But is it really that USB thumb drive? Yes! Look at the volume serial number, it matches the one extracted from USB devices artifacts!

But that’s not all! There are more artifacts! Now look at LNK files, we also filtered Linked Path column with “E:” keyword. Now we have 14 artifacts, let’s look at the details of one of them.

Figure 5. Information extracted from Secrets.lnk by Magnet AXIOM

Again, we see, that Secrets.rtf was copied to a flash drive with “E” drive letter and 58E3D488 volume serial number. Also, we see the date and time it was copied – 9/8/2017 8:53:24 AM (UTC).

Conclusion

As you can see, we can find digital evidence of sensitive data being copied to a USB thumb drive even without examination of this drive. Of course, it’s not always possible and depends on employee’s habits, but nevertheless, you should always try.

Happy forensicating!

About the authors

Oleg Skulkin, MCFE, ACE, is a DFIR enthusional (enthusiast + professional) and Windows Forensics Cookbook co-author.

Igor Mikhaylov, MCFE, ACE, OSFCE, is a digital forensic examiner with more than 20 years of experience and Mobile Forensics Cookbook author.

Load More Related Articles
Load More In Articles

No Comments

  1. Howarddrymn

    April 16, 2019 at 1:29 pm

    Your comment is awaiting moderation.

    You said that adequately.
    http://talahicc.com/
    mail order pharmacy
    canadian online pharmacies
    canadian rx pharmacy online
    [url=http://canadianpharmaciescubarx.com/]online pharmacies canada[/url]

    Reply

  2. Howarddrymn

    April 16, 2019 at 5:53 pm

    Your comment is awaiting moderation.

    You stated it very well!
    http://canadianpharmacyntx.com/
    drugstore online canadian pharmacies canadian pharmacy [url=http://talahicc.com/]online pharmacies canada[/url]
    canada drug
    discount pharmacy
    pharmacy prices compare
    canada drug
    mexican pharmacies
    drug costs

    Reply

  3. Howarddrymn

    April 16, 2019 at 6:30 pm

    Your comment is awaiting moderation.

    This is nicely put! !
    http://canadianpharmacyntx.com/
    best canadian mail order pharmacies london drugs canada prescription drugs without prior prescription [url=http://canadianpharmaciesnnm.com/]canada drug[/url]
    most reliable canadian pharmacies
    canadian online pharmacy
    canada drugs pharmacy
    safe canadian online pharmacies
    canadian pharmacies that ship to us
    drug prices comparison

    Reply

  4. Howarddrymn

    April 16, 2019 at 6:55 pm

    Your comment is awaiting moderation.

    Useful postings. Regards.
    http://canadianpharmacysilo.com/
    price prescription drugs canada pharmaceuticals online canada drug [url=http://canadianpharmaciescubarx.com/]canada drug[/url]
    canadian mail order pharmacies
    canadian discount pharmacy
    pharmacy canada
    canadian drug stores online
    online pharmacy reviews
    candrugstore com

    Reply

  5. Howarddrymn

    April 16, 2019 at 7:19 pm

    Your comment is awaiting moderation.

    You actually revealed it perfectly.
    http://talahicc.com/
    canadian drug canadian pharmaceuticals online online pharmacy usa [url=https://nicktambone.com/]canadian cialis[/url]
    canadian online pharmacies prescription drugs
    online canadian discount pharmacy
    cheap prescription drugs online
    canadadrugs
    drugs online
    prescription without a doctor’s prescription

    Reply

  6. Howarddrymn

    April 16, 2019 at 8:13 pm

    Your comment is awaiting moderation.

    Thank you, Excellent stuff!
    https://nicktambone.com/
    canadian pharmacy canadian pharmaceuticals online online pharmacy canada [url=http://canadianpharmacyntx.com/]online pharmacies of canada[/url]
    pharmacy price compare
    canadian pharmacies that are legit
    buy prescription drugs canada
    canadadrugs
    pharmacy price compare
    buying prescription drugs canada

    Reply

  7. Howarddrymn

    April 16, 2019 at 9:30 pm

    Your comment is awaiting moderation.

    Wow tons of excellent material.
    http://canadianpharmacyntx.com/
    prescription without a doctor’s prescription canadian online pharmacies cialis online [url=http://www.canadianpharmacymsn.com/]canadian pharmacies[/url]
    pharmacy price compare
    legitimate canadian mail order pharmacies
    overseas pharmacy forum
    best non prescription online pharmacies
    canadian pharmacy viagra brand
    canadian pharmacies top best

    Reply

  8. Howarddrymn

    April 16, 2019 at 9:46 pm

  9. Howarddrymn

    April 16, 2019 at 10:49 pm

    Your comment is awaiting moderation.

    You actually suggested it wonderfully!
    http://canadianpharmaciescubarx.com/
    pharmacy price comparison northwestpharmacy pharmacy online [url=http://canadianpharmacysilo.com/]canada pharmaceutical online ordering[/url]
    cheap prescription drugs online
    mail order pharmacies
    prescription cost comparison
    best online international pharmacies
    canadian pharmacies online prescriptions
    canadian mail order pharmacies

    Reply

  10. Howarddrymn

    April 16, 2019 at 11:28 pm

    Your comment is awaiting moderation.

    Nicely put. Many thanks!
    http://canadianpharmaciesnnm.com/
    best online canadian pharcharmy global pharmacy canada discount pharmaceuticals [url=http://canadianpharmacymim.com/]canadian pharmacies that ship to us[/url]
    canadian pharmacy online canada
    canadapharmacy
    pharmacy price comparison
    prescription drugs canada
    cheap prescription drugs online
    highest rated canadian pharmacies

    Reply

  11. Howarddrymn

    April 16, 2019 at 11:53 pm

    Your comment is awaiting moderation.

    Great posts. Thanks!
    http://canadianpharmacymim.com/
    trust pharmacy canada trust pharmacy canada canadapharmacyonline.com [url=http://canadianpharmaciescubarx.com/]canada pharmaceuticals online[/url]
    best canadian pharmacies
    canadian online pharmacies prescription drugs
    trusted overseas pharmacies
    northwest pharmacy
    canada pharmacy online reviews
    safeway pharmacy

    Reply

  12. Howarddrymn

    April 17, 2019 at 12:18 am

    Your comment is awaiting moderation.

    Thanks, Lots of information!
    https://nicktambone.com/
    canadian drugstore canadian pharmacies online canadian discount pharmacy [url=http://talahicc.com/]canadian pharmacies[/url]
    canadian pharmacy viagra brand
    walmart pharmacy price check
    overseas pharmacies
    drugs online
    canadian prescriptions
    pharmacy online

    Reply

  13. Howarddrymn

    April 17, 2019 at 1:14 am

    Your comment is awaiting moderation.

    Wonderful stuff, Appreciate it.
    http://canadianpharmacymim.com/
    medical information online online pharmacies of canada canadian online pharmacies [url=http://canadianpharmacyntx.com/]northwestpharmacy[/url]
    drug costs
    online drugstore
    pharmacy cost comparison
    canadadrugs.com pharmacy
    my canadian pharmacy
    compare prescription prices

    Reply

  14. Howarddrymn

    April 17, 2019 at 2:33 am

    Your comment is awaiting moderation.

    With thanks, A good amount of advice!
    http://canadianpharmacymim.com/
    canada drug pharmacy canadian pharmacies without an rx pharmacy without dr prescriptions [url=http://canadianpharmacyntx.com/]london drugs canada[/url]
    drugstore online
    best canadian mail order pharmacies
    canadian drug stores online
    drug price
    best non prescription online pharmacies
    drugs for sale

    Reply

  15. Howarddrymn

    April 17, 2019 at 2:50 am

    Your comment is awaiting moderation.

    Thanks a lot. A good amount of write ups!
    http://talahicc.com/
    canada pharmacies without script canadianpharmacy canada pharmacy online [url=http://talahicc.com/]mexican pharmacies shipping to usa[/url]
    online pharmacy usa
    best online pharmacies no prescription
    pharmacies near me
    pharmacy prices compare
    best canadian online pharmacy
    canadian drug store

    Reply

  16. Quentinexext

    April 17, 2019 at 5:01 am

    Your comment is awaiting moderation.

    Kudos, Lots of stuff!
    https://nicktambone.com/
    trusted overseas pharmacies canadianpharmacy canadian family pharmacy [url=http://canadianpharmacymim.com/]canadian online pharmacies[/url]
    northwest pharmacy
    canada online pharmacy
    canadian prescriptions
    prescription without a doctor’s prescription
    canadian drug stores online
    best canadian prescription prices

    Reply

  17. Quentinexext

    April 17, 2019 at 5:27 am

    Your comment is awaiting moderation.

    Thank you. An abundance of facts!
    http://canadianpharmacyntx.com/
    canadian pharmacy meds canadian cialis canadian pharmacies without prescriptions [url=http://canadianpharmaciesnnm.com/]canada drugs online[/url]
    canadian drug stores online
    drugs online
    prescription drug cost
    canada drug
    drugs without prescription
    canadian pharmacies online prescriptions

    Reply

  18. Quentinexext

    April 17, 2019 at 6:24 am

    Your comment is awaiting moderation.

    Beneficial content. Thanks a lot!
    http://canadianpharmaciesnnm.com/
    canadian drugstore reviews canada drugs online best non prescription online pharmacies [url=http://www.canadianpharmacymsn.com/]northwestpharmacy[/url]
    canada drugs online pharmacy
    canadian online pharmacy reviews
    pharmacy canada
    best canadian mail order pharmacies
    get prescription online
    best non prescription online pharmacies

    Reply

  19. Quentinexext

    April 17, 2019 at 8:03 am

    Your comment is awaiting moderation.

    You’ve made the point.
    http://canadianpharmacymim.com/
    international pharmacy canada pharmaceuticals online drugs online [url=http://canadianpharmacyntx.com/]canadian pharmacy[/url]
    canadian pharmacy meds
    canada drugs online pharmacy
    canadian prescription drugs
    buy cialis
    best online pharmacy
    online pharmacy usa

    Reply

  20. Quentinexext

    April 17, 2019 at 9:53 am

    Your comment is awaiting moderation.

    Many thanks, I appreciate this.
    https://nicktambone.com/
    canada pharmacies online prescriptions mexican pharmacies shipping to usa prescription price comparison [url=http://talahicc.com/]canadian pharmacy online[/url]
    best canadian prescription prices
    prescription drug cost
    prescription drugs online without
    buy prescription drugs without doctor
    buy cialis
    canadian pharmacies that ship to us

    Reply

  21. Quentinexext

    April 17, 2019 at 10:20 am

    Your comment is awaiting moderation.

    Many thanks. I enjoy this.
    http://www.canadianpharmacymsn.com/
    mail order pharmacy aarp approved canadian online pharmacies canada drugs online pharmacy [url=http://talahicc.com/]northwest pharmacy[/url]
    canada pharmacies online prescriptions
    pharmacy cost comparison
    canadian pharmacies
    online pharmacies canada
    drugs for sale
    canadian pharmacies online

    Reply

  22. Quentinexext

    April 17, 2019 at 10:47 am

    Your comment is awaiting moderation.

    Regards. I appreciate it.
    http://www.canadianpharmacymsn.com/
    online pharmacy canadian viagra discount pharmaceuticals [url=http://canadianpharmaciesnnm.com/]canada drug[/url]
    canadianpharmacy
    canadian pharmacy viagra
    pharmacy tech
    canadian online pharmacies prescription drugs
    walmart pharmacy price check
    highest rated canadian pharmacies

    Reply

  23. Quentinexext

    April 17, 2019 at 11:46 am

    Your comment is awaiting moderation.

    You actually revealed this effectively.
    http://canadianpharmaciesnnm.com/
    online pharmacies canada online pharmacies rx online [url=http://www.canadianpharmacymsn.com/]canada drugs online[/url]
    approved canadian pharmacies online
    pharmacy prescription
    buy prescription drugs without doctor
    online canadian pharmacy
    canadian online pharmacy
    canadian pharmacies

    Reply

  24. Quentinexext

    April 17, 2019 at 1:10 pm

    Your comment is awaiting moderation.

    Great facts, With thanks.
    http://canadianpharmacyntx.com/
    pharmacy cost comparison canadian drugs best online canadian pharcharmy [url=http://canadianonlinepharmacynnm.com/]northwest pharmacy[/url]
    my canadian pharmacy
    best non prescription online pharmacies
    prescription cost comparison
    prescription drugs without prior prescription
    buying drugs canada
    northwestpharmacy

    Reply

  25. Quentinexext

    April 17, 2019 at 1:33 pm

    Your comment is awaiting moderation.

    Fantastic postings. Regards!
    http://canadianpharmacyntx.com/
    canada pharmacies online pharmacy northwestpharmacy canadian pharmacy no prescription needed [url=https://nicktambone.com/]canada pharmaceutical online ordering[/url]
    pharmacy price compare
    canada drugs pharmacy
    mexican pharmacy online medications
    pharmacy online mexico
    buy drugs online
    rx online

    Reply

  26. Quentinexext

    April 17, 2019 at 2:38 pm

    Your comment is awaiting moderation.

    Cheers! An abundance of information!
    http://canadianpharmacymim.com/
    pharmacies in canada london drugs canada rx pharmacy [url=http://canadianpharmacysilo.com/]trust pharmacy canada[/url]
    canadian pharmacy 365
    canadian discount pharmacy
    canada pharmacy online no script
    canadapharmacy
    canadian discount pharmacy
    overseas pharmacies

    Reply

  27. Quentinexext

    April 17, 2019 at 3:19 pm

    Your comment is awaiting moderation.

    You stated it adequately!
    http://canadianonlinepharmacynnm.com/
    canadian cialis northwest pharmacy overseas pharmacy forum [url=http://canadianpharmacysilo.com/]canadian pharmacy online[/url]
    canadapharmacyonline com
    online canadian discount pharmacy
    drugs online
    overseas pharmacy forum
    canadian online pharmacy reviews
    canadapharmacyonline com

    Reply

  28. Quentinexext

    April 17, 2019 at 3:47 pm

    Your comment is awaiting moderation.

    Tips nicely used..
    http://canadianpharmacyntx.com/
    canadadrugs canada pharmacy online prescription drug cost [url=http://canadianpharmaciesnnm.com/]canada pharmaceuticals online[/url]
    mexican online pharmacies
    cheap prescription drugs
    prescription prices comparison
    mexican online pharmacies
    online prescription drugs
    canada drugs online

    Reply

  29. Quentinexext

    April 17, 2019 at 4:15 pm

    Your comment is awaiting moderation.

    You said that superbly!
    http://canadianpharmacysilo.com/
    canadian cialis northwest pharmacy online rx pharmacy [url=http://canadianpharmacysilo.com/]canadian pharmacies[/url]
    canadian pharmacy viagra
    discount pharmacy
    online pharmacies no prescription
    drug price
    canada pharmacies online pharmacy
    best canadian online pharmacy

    Reply

  30. Quentinexext

    April 17, 2019 at 5:14 pm

    Your comment is awaiting moderation.

    Good postings. Thank you!
    http://www.canadianpharmacymsn.com/
    internet pharmacy canada drugs online prescription cost [url=http://canadianpharmaciesnnm.com/]trust pharmacy canada[/url]
    cialis online
    board of pharmacy
    online pharmacy reviews
    canadian online pharmacies
    medication costs
    mexican online pharmacies

    Reply

  31. Quentinexext

    April 17, 2019 at 6:58 pm

    Your comment is awaiting moderation.

    You said it nicely..
    http://canadianpharmacymim.com/
    discount prescription drugs online canadian online pharmacy prescription drugs without prior prescription [url=http://talahicc.com/]london drugs canada[/url]
    international pharmacy
    canadian mail order pharmacies
    top rated online canadian pharmacies
    global pharmacy canada
    northwestpharmacy
    approved canadian pharmacies online

    Reply

  32. Quentinexext

    April 17, 2019 at 7:04 pm

    Your comment is awaiting moderation.

    Cheers, A good amount of information!
    http://www.canadianpharmacymsn.com/
    canada online pharmacies trust pharmacy canada top rated canadian pharmacies online [url=http://canadianpharmaciescubarx.com/]canadian viagra[/url]
    reputable canadian mail order pharmacies
    top rated online canadian pharmacies
    canadian pharmacies online prescriptions
    board of pharmacy
    mexican pharmacies shipping to usa
    the canadian pharmacy

    Reply

  33. Quentinexext

    April 17, 2019 at 8:10 pm

    Your comment is awaiting moderation.

    With thanks. A good amount of forum posts!
    http://canadianpharmacysilo.com/
    pharmacy online store canadian viagra the canadian pharmacy [url=http://canadianpharmacyntx.com/]canadianpharmacy[/url]
    canadian prescription
    canada online pharmacy
    drugstore online
    trusted overseas pharmacies
    online pharmacy usa
    reputable canadian mail order pharmacies

    Reply

  34. Quentinexext

    April 17, 2019 at 9:19 pm

    Your comment is awaiting moderation.

    Many thanks! Lots of information!
    http://canadianpharmacymim.com/
    canadian pharmacies that are legit canadian pharmacy online canada online pharmacy [url=http://canadianpharmaciesnnm.com/]canadian pharmacy[/url]
    canadian pharmacy uk delivery
    medication costs
    discount drugs online pharmacy
    prescription drugs prices
    canadian online pharmacies prescription drugs
    canadian pharmacy meds

    Reply

  35. Quentinexext

    April 18, 2019 at 12:19 am

    Your comment is awaiting moderation.

    You actually revealed this exceptionally well!
    http://canadianpharmaciesnnm.com/
    compare prescription prices canada drug drug price [url=http://canadianpharmaciesnnm.com/]global pharmacy canada[/url]
    prescription drug cost
    online canadian pharmacies
    online pharmacy usa
    best canadian pharmacies
    drugs without prescription
    discount pharmacy online

    Reply

  36. Quentinexext

    April 18, 2019 at 12:37 am

    Your comment is awaiting moderation.

    Nicely put, With thanks!
    http://www.canadianpharmacymsn.com/
    best canadian prescription prices northwestpharmacy canadian drugstore reviews [url=http://canadianpharmaciescubarx.com/]canadian pharcharmy[/url]
    drug price
    best online pharmacy
    buy prescription drugs without doctor
    pharmacy canada
    canadian family pharmacy
    top rated online canadian pharmacies

    Reply

  37. Quentinexext

    April 18, 2019 at 1:51 am

    Your comment is awaiting moderation.

    You said it adequately..
    http://canadianpharmacysilo.com/
    buy online prescription drugs top rated canadian pharmacies online canadian pharmacies online prescriptions [url=https://nicktambone.com/]canadian pharmaceuticals online[/url]
    mexican pharmacy online medications
    rx pharmacy
    canadapharmacy com
    no prescription online pharmacy
    pharmacy canada
    canada drugs pharmacy

    Reply

  38. Quentinexext

    April 18, 2019 at 2:35 am

    Your comment is awaiting moderation.

    Helpful facts. Appreciate it.
    http://canadianpharmacysilo.com/
    drugstore online canada pharmacy online canadian online pharmacies prescription drugs [url=http://canadianpharmacysilo.com/]canadianpharmacy[/url]
    meds online
    candrugstore com
    online prescription drugs
    pharmacy canada
    canada pharmacy online no script
    canadian pharmacy 365

    Reply

  39. Quentinexext

    April 18, 2019 at 3:05 am

    Your comment is awaiting moderation.

    You stated that superbly.
    http://canadianpharmacysilo.com/
    canadian drugstore online canada drugs no prior prescription required pharmacy [url=http://canadianpharmacymim.com/]canada drugs online[/url]
    medication costs
    prescription drug price comparison
    best canadian mail order pharmacies
    canadian pharmacy 365
    visit poster’s website
    canadian pharmacies online

    Reply

  40. Quentinexext

    April 18, 2019 at 3:33 am

    Your comment is awaiting moderation.

    Superb facts. Thank you.
    http://canadianpharmacyntx.com/
    legitimate online pharmacies trust pharmacy canada buy drugs online [url=http://canadianpharmaciesnnm.com/]canadian pharmacies[/url]
    buying drugs canada
    pharmacy without dr prescriptions
    canadian drugstore online
    no 1 canadian pharcharmy online
    cheap prescription drugs
    canadian pharmacy viagra

    Reply

Leave a Reply

Your email address will not be published. Required fields are marked *