If you are a digital forensic examiner, you must know, that clients very often ask to find out, which sensitive files were copied to USB thumb drives by disgruntled employees before they left the company. There are a lot of articles and guides on USB forensics on the Web, but most of them dealing with the flash drives and not the computer used by the employee. It seems quite strange to us as usually you have the computer’s drive or an image if the computer’s drive. So we have decided to write a USB forensics guide, which shows what to do if you have only computer’s image, and not the image of the USB thumb drive used for copying sensitive data.
Scenario
First, we created a Windows 10 virtual machine using Oracle Virtual Box. After we created three files with Windows Wordpad on the Desktop: Secrets.rtf, Confidential.rtf and Clients.rtf. We connected a USB thumb drive to our virtual machine, copied these files, and checked if they were copied correctly by opening them. Finally, we performed a normal shut down operation.
We used VDI file and Magnet AXIOM for its forensic examination. Thankfully, AXIOM supports these virtual machine files. For example, FTK Imager doesn’t display VDI contents correctly.
Examination
For testing purposes, we processed our VDI file with default settings. We are interested in operating system artifacts, so let’s go straight to corresponding category.
Figure 1. Operating system artifacts extracted by Magnet AXIOM
Let’s start from identifying connected USB thumb drives. As you can see on figure 1, AXIOM already extracted this information from Windows registry for us.
Figure 2. USB devices list extracted by Magnet AXIOM
We have only one interesting device (highlighted), let’s check artifact details – look at figure 3.
Figure 3. Interesting USB device details
So, suspicious device was last connected on 9/8/2017 at 8:52:57 AM (UTC), was assigned “E” drive letter and had 58E3D488 as volume serial number. Let’s go further and identify the files copied to this flash drive.
Let’s start from the Jump Lists. According to Magnet Artifacts Reference Guide, Jump lists are “quick lists of recent applications or files that a user launched”. We have filtered Linked Path column with “E:” keyword and got six artifacts, you can see them on figure 4.
Figure 4. Relevant Jump Lists artifacts
As you can see, now we have the evidence, that our sensitive files were transferred to an external drive with “E” letter assigned. But is it really that USB thumb drive? Yes! Look at the volume serial number, it matches the one extracted from USB devices artifacts!
But that’s not all! There are more artifacts! Now look at LNK files, we also filtered Linked Path column with “E:” keyword. Now we have 14 artifacts, let’s look at the details of one of them.
Figure 5. Information extracted from Secrets.lnk by Magnet AXIOM
Again, we see, that Secrets.rtf was copied to a flash drive with “E” drive letter and 58E3D488 volume serial number. Also, we see the date and time it was copied – 9/8/2017 8:53:24 AM (UTC).
Conclusion
As you can see, we can find digital evidence of sensitive data being copied to a USB thumb drive even without examination of this drive. Of course, it’s not always possible and depends on employee’s habits, but nevertheless, you should always try.
Happy forensicating!
About the authors
Oleg Skulkin, MCFE, ACE, is a DFIR enthusional (enthusiast + professional) and Windows Forensics Cookbook co-author.
Igor Mikhaylov, MCFE, ACE, OSFCE, is a digital forensic examiner with more than 20 years of experience and Mobile Forensics Cookbook author.
Howarddrymn
April 16, 2019 at 1:29 pm
Your comment is awaiting moderation.
You said that adequately.
http://talahicc.com/
mail order pharmacy
canadian online pharmacies
canadian rx pharmacy online
[url=http://canadianpharmaciescubarx.com/]online pharmacies canada[/url]
Howarddrymn
April 16, 2019 at 5:53 pm
Your comment is awaiting moderation.
You stated it very well!
http://canadianpharmacyntx.com/
drugstore online canadian pharmacies canadian pharmacy [url=http://talahicc.com/]online pharmacies canada[/url]
canada drug
discount pharmacy
pharmacy prices compare
canada drug
mexican pharmacies
drug costs
Howarddrymn
April 16, 2019 at 6:30 pm
Your comment is awaiting moderation.
This is nicely put! !
http://canadianpharmacyntx.com/
best canadian mail order pharmacies london drugs canada prescription drugs without prior prescription [url=http://canadianpharmaciesnnm.com/]canada drug[/url]
most reliable canadian pharmacies
canadian online pharmacy
canada drugs pharmacy
safe canadian online pharmacies
canadian pharmacies that ship to us
drug prices comparison
Howarddrymn
April 16, 2019 at 6:55 pm
Your comment is awaiting moderation.
Useful postings. Regards.
http://canadianpharmacysilo.com/
price prescription drugs canada pharmaceuticals online canada drug [url=http://canadianpharmaciescubarx.com/]canada drug[/url]
canadian mail order pharmacies
canadian discount pharmacy
pharmacy canada
canadian drug stores online
online pharmacy reviews
candrugstore com
Howarddrymn
April 16, 2019 at 7:19 pm
Your comment is awaiting moderation.
You actually revealed it perfectly.
http://talahicc.com/
canadian drug canadian pharmaceuticals online online pharmacy usa [url=https://nicktambone.com/]canadian cialis[/url]
canadian online pharmacies prescription drugs
online canadian discount pharmacy
cheap prescription drugs online
canadadrugs
drugs online
prescription without a doctor’s prescription
Howarddrymn
April 16, 2019 at 8:13 pm
Your comment is awaiting moderation.
Thank you, Excellent stuff!
https://nicktambone.com/
canadian pharmacy canadian pharmaceuticals online online pharmacy canada [url=http://canadianpharmacyntx.com/]online pharmacies of canada[/url]
pharmacy price compare
canadian pharmacies that are legit
buy prescription drugs canada
canadadrugs
pharmacy price compare
buying prescription drugs canada
Howarddrymn
April 16, 2019 at 9:30 pm
Your comment is awaiting moderation.
Wow tons of excellent material.
http://canadianpharmacyntx.com/
prescription without a doctor’s prescription canadian online pharmacies cialis online [url=http://www.canadianpharmacymsn.com/]canadian pharmacies[/url]
pharmacy price compare
legitimate canadian mail order pharmacies
overseas pharmacy forum
best non prescription online pharmacies
canadian pharmacy viagra brand
canadian pharmacies top best
Howarddrymn
April 16, 2019 at 9:46 pm
Your comment is awaiting moderation.
You made your point.
http://www.canadianpharmacymsn.com/
pharmacies near me canadian online pharmacies international pharmacy [url=http://canadianpharmacysilo.com/]online pharmacies canada[/url]
no prescription pharmacy
canada pharmacy
<a href="http://shket.ua/product/sabo-osminog-goluboy-24-jose-amorales-117074/?DIGNITY=+Nicely+put.+With+thanks.+http%3A%2F%2Fcialismsnrx.com%2F+que+es+mas+eficaz+cialis+o+viagra+cialis+20+mg+%0D%0Asite+sur+pour+acheter+du+cialis+%0D%0Abuy+cialis+online&SHORTCOMINGS=+%0D%0ANicely+put.+With+thanks.+%0D%0Ahttp%3A%2F%2Fcialismsnrx.com%2F+%0D%0Aque+es+mas+eficaz+cialis+o+viagra+%0D%0Acialis+20+mg+%0D%0Asite+sur+pour+acheter+du+cialis+%0D%0Abuy+cialis+online&COMMENT=+%0D%0ANicely+put.+With+thanks.+%0D%0Ahttp%3A%2F%2Fcialismsnrx.com%2F+%0D%0Aque+es+mas+eficaz+cialis+o+viagra+%0D%0Acialis+20+mg+%0D%0Asite+sur+pour+acheter+du+cialis+%0D%0Abuy+cialis+online&NAME=Haroldhip&USED=&RATING=0&PRODUCT_NAME=%D0%A1%D0%B0%D0%B1%D0%BE+%D0%9E%D1%81%D1%8C%D0%BC%D0%B8%D0%BD%D0%BE%D0%B3+%D0%93%D0%BE%D0%BB%D1%83%D0%B1%D0%BE%D0%B9+24+Jose+Amorales+%28117074%29&PRODUCT_ID=48024″>canadadrugs.com pharmacy
canadian pharmacy meds
canada online pharmacy
online pharmacy reviews
Howarddrymn
April 16, 2019 at 10:49 pm
Your comment is awaiting moderation.
You actually suggested it wonderfully!
http://canadianpharmaciescubarx.com/
pharmacy price comparison northwestpharmacy pharmacy online [url=http://canadianpharmacysilo.com/]canada pharmaceutical online ordering[/url]
cheap prescription drugs online
mail order pharmacies
prescription cost comparison
best online international pharmacies
canadian pharmacies online prescriptions
canadian mail order pharmacies
Howarddrymn
April 16, 2019 at 11:28 pm
Your comment is awaiting moderation.
Nicely put. Many thanks!
http://canadianpharmaciesnnm.com/
best online canadian pharcharmy global pharmacy canada discount pharmaceuticals [url=http://canadianpharmacymim.com/]canadian pharmacies that ship to us[/url]
canadian pharmacy online canada
canadapharmacy
pharmacy price comparison
prescription drugs canada
cheap prescription drugs online
highest rated canadian pharmacies
Howarddrymn
April 16, 2019 at 11:53 pm
Your comment is awaiting moderation.
Great posts. Thanks!
http://canadianpharmacymim.com/
trust pharmacy canada trust pharmacy canada canadapharmacyonline.com [url=http://canadianpharmaciescubarx.com/]canada pharmaceuticals online[/url]
best canadian pharmacies
canadian online pharmacies prescription drugs
trusted overseas pharmacies
northwest pharmacy
canada pharmacy online reviews
safeway pharmacy
Howarddrymn
April 17, 2019 at 12:18 am
Your comment is awaiting moderation.
Thanks, Lots of information!
https://nicktambone.com/
canadian drugstore canadian pharmacies online canadian discount pharmacy [url=http://talahicc.com/]canadian pharmacies[/url]
canadian pharmacy viagra brand
walmart pharmacy price check
overseas pharmacies
drugs online
canadian prescriptions
pharmacy online
Howarddrymn
April 17, 2019 at 1:14 am
Your comment is awaiting moderation.
Wonderful stuff, Appreciate it.
http://canadianpharmacymim.com/
medical information online online pharmacies of canada canadian online pharmacies [url=http://canadianpharmacyntx.com/]northwestpharmacy[/url]
drug costs
online drugstore
pharmacy cost comparison
canadadrugs.com pharmacy
my canadian pharmacy
compare prescription prices
Howarddrymn
April 17, 2019 at 2:33 am
Your comment is awaiting moderation.
With thanks, A good amount of advice!
http://canadianpharmacymim.com/
canada drug pharmacy canadian pharmacies without an rx pharmacy without dr prescriptions [url=http://canadianpharmacyntx.com/]london drugs canada[/url]
drugstore online
best canadian mail order pharmacies
canadian drug stores online
drug price
best non prescription online pharmacies
drugs for sale
Howarddrymn
April 17, 2019 at 2:50 am
Your comment is awaiting moderation.
Thanks a lot. A good amount of write ups!
http://talahicc.com/
canada pharmacies without script canadianpharmacy canada pharmacy online [url=http://talahicc.com/]mexican pharmacies shipping to usa[/url]
online pharmacy usa
best online pharmacies no prescription
pharmacies near me
pharmacy prices compare
best canadian online pharmacy
canadian drug store
Quentinexext
April 17, 2019 at 5:01 am
Your comment is awaiting moderation.
Kudos, Lots of stuff!
https://nicktambone.com/
trusted overseas pharmacies canadianpharmacy canadian family pharmacy [url=http://canadianpharmacymim.com/]canadian online pharmacies[/url]
northwest pharmacy
canada online pharmacy
canadian prescriptions
prescription without a doctor’s prescription
canadian drug stores online
best canadian prescription prices
Quentinexext
April 17, 2019 at 5:27 am
Your comment is awaiting moderation.
Thank you. An abundance of facts!
http://canadianpharmacyntx.com/
canadian pharmacy meds canadian cialis canadian pharmacies without prescriptions [url=http://canadianpharmaciesnnm.com/]canada drugs online[/url]
canadian drug stores online
drugs online
prescription drug cost
canada drug
drugs without prescription
canadian pharmacies online prescriptions
Quentinexext
April 17, 2019 at 6:24 am
Your comment is awaiting moderation.
Beneficial content. Thanks a lot!
http://canadianpharmaciesnnm.com/
canadian drugstore reviews canada drugs online best non prescription online pharmacies [url=http://www.canadianpharmacymsn.com/]northwestpharmacy[/url]
canada drugs online pharmacy
canadian online pharmacy reviews
pharmacy canada
best canadian mail order pharmacies
get prescription online
best non prescription online pharmacies
Quentinexext
April 17, 2019 at 8:03 am
Your comment is awaiting moderation.
You’ve made the point.
http://canadianpharmacymim.com/
international pharmacy canada pharmaceuticals online drugs online [url=http://canadianpharmacyntx.com/]canadian pharmacy[/url]
canadian pharmacy meds
canada drugs online pharmacy
canadian prescription drugs
buy cialis
best online pharmacy
online pharmacy usa
Quentinexext
April 17, 2019 at 9:53 am
Your comment is awaiting moderation.
Many thanks, I appreciate this.
https://nicktambone.com/
canada pharmacies online prescriptions mexican pharmacies shipping to usa prescription price comparison [url=http://talahicc.com/]canadian pharmacy online[/url]
best canadian prescription prices
prescription drug cost
prescription drugs online without
buy prescription drugs without doctor
buy cialis
canadian pharmacies that ship to us
Quentinexext
April 17, 2019 at 10:20 am
Your comment is awaiting moderation.
Many thanks. I enjoy this.
http://www.canadianpharmacymsn.com/
mail order pharmacy aarp approved canadian online pharmacies canada drugs online pharmacy [url=http://talahicc.com/]northwest pharmacy[/url]
canada pharmacies online prescriptions
pharmacy cost comparison
canadian pharmacies
online pharmacies canada
drugs for sale
canadian pharmacies online
Quentinexext
April 17, 2019 at 10:47 am
Your comment is awaiting moderation.
Regards. I appreciate it.
http://www.canadianpharmacymsn.com/
online pharmacy canadian viagra discount pharmaceuticals [url=http://canadianpharmaciesnnm.com/]canada drug[/url]
canadianpharmacy
canadian pharmacy viagra
pharmacy tech
canadian online pharmacies prescription drugs
walmart pharmacy price check
highest rated canadian pharmacies
Quentinexext
April 17, 2019 at 11:46 am
Your comment is awaiting moderation.
You actually revealed this effectively.
http://canadianpharmaciesnnm.com/
online pharmacies canada online pharmacies rx online [url=http://www.canadianpharmacymsn.com/]canada drugs online[/url]
approved canadian pharmacies online
pharmacy prescription
buy prescription drugs without doctor
online canadian pharmacy
canadian online pharmacy
canadian pharmacies
Quentinexext
April 17, 2019 at 1:10 pm
Your comment is awaiting moderation.
Great facts, With thanks.
http://canadianpharmacyntx.com/
pharmacy cost comparison canadian drugs best online canadian pharcharmy [url=http://canadianonlinepharmacynnm.com/]northwest pharmacy[/url]
my canadian pharmacy
best non prescription online pharmacies
prescription cost comparison
prescription drugs without prior prescription
buying drugs canada
northwestpharmacy
Quentinexext
April 17, 2019 at 1:33 pm
Your comment is awaiting moderation.
Fantastic postings. Regards!
http://canadianpharmacyntx.com/
canada pharmacies online pharmacy northwestpharmacy canadian pharmacy no prescription needed [url=https://nicktambone.com/]canada pharmaceutical online ordering[/url]
pharmacy price compare
canada drugs pharmacy
mexican pharmacy online medications
pharmacy online mexico
buy drugs online
rx online
Quentinexext
April 17, 2019 at 2:38 pm
Your comment is awaiting moderation.
Cheers! An abundance of information!
http://canadianpharmacymim.com/
pharmacies in canada london drugs canada rx pharmacy [url=http://canadianpharmacysilo.com/]trust pharmacy canada[/url]
canadian pharmacy 365
canadian discount pharmacy
canada pharmacy online no script
canadapharmacy
canadian discount pharmacy
overseas pharmacies
Quentinexext
April 17, 2019 at 3:19 pm
Your comment is awaiting moderation.
You stated it adequately!
http://canadianonlinepharmacynnm.com/
canadian cialis northwest pharmacy overseas pharmacy forum [url=http://canadianpharmacysilo.com/]canadian pharmacy online[/url]
canadapharmacyonline com
online canadian discount pharmacy
drugs online
overseas pharmacy forum
canadian online pharmacy reviews
canadapharmacyonline com
Quentinexext
April 17, 2019 at 3:47 pm
Your comment is awaiting moderation.
Tips nicely used..
http://canadianpharmacyntx.com/
canadadrugs canada pharmacy online prescription drug cost [url=http://canadianpharmaciesnnm.com/]canada pharmaceuticals online[/url]
mexican online pharmacies
cheap prescription drugs
prescription prices comparison
mexican online pharmacies
online prescription drugs
canada drugs online
Quentinexext
April 17, 2019 at 4:15 pm
Your comment is awaiting moderation.
You said that superbly!
http://canadianpharmacysilo.com/
canadian cialis northwest pharmacy online rx pharmacy [url=http://canadianpharmacysilo.com/]canadian pharmacies[/url]
canadian pharmacy viagra
discount pharmacy
online pharmacies no prescription
drug price
canada pharmacies online pharmacy
best canadian online pharmacy
Quentinexext
April 17, 2019 at 5:14 pm
Your comment is awaiting moderation.
Good postings. Thank you!
http://www.canadianpharmacymsn.com/
internet pharmacy canada drugs online prescription cost [url=http://canadianpharmaciesnnm.com/]trust pharmacy canada[/url]
cialis online
board of pharmacy
online pharmacy reviews
canadian online pharmacies
medication costs
mexican online pharmacies
Quentinexext
April 17, 2019 at 6:58 pm
Your comment is awaiting moderation.
You said it nicely..
http://canadianpharmacymim.com/
discount prescription drugs online canadian online pharmacy prescription drugs without prior prescription [url=http://talahicc.com/]london drugs canada[/url]
international pharmacy
canadian mail order pharmacies
top rated online canadian pharmacies
global pharmacy canada
northwestpharmacy
approved canadian pharmacies online
Quentinexext
April 17, 2019 at 7:04 pm
Your comment is awaiting moderation.
Cheers, A good amount of information!
http://www.canadianpharmacymsn.com/
canada online pharmacies trust pharmacy canada top rated canadian pharmacies online [url=http://canadianpharmaciescubarx.com/]canadian viagra[/url]
reputable canadian mail order pharmacies
top rated online canadian pharmacies
canadian pharmacies online prescriptions
board of pharmacy
mexican pharmacies shipping to usa
the canadian pharmacy
Quentinexext
April 17, 2019 at 8:10 pm
Your comment is awaiting moderation.
With thanks. A good amount of forum posts!
http://canadianpharmacysilo.com/
pharmacy online store canadian viagra the canadian pharmacy [url=http://canadianpharmacyntx.com/]canadianpharmacy[/url]
canadian prescription
canada online pharmacy
drugstore online
trusted overseas pharmacies
online pharmacy usa
reputable canadian mail order pharmacies
Quentinexext
April 17, 2019 at 9:19 pm
Your comment is awaiting moderation.
Many thanks! Lots of information!
http://canadianpharmacymim.com/
canadian pharmacies that are legit canadian pharmacy online canada online pharmacy [url=http://canadianpharmaciesnnm.com/]canadian pharmacy[/url]
canadian pharmacy uk delivery
medication costs
discount drugs online pharmacy
prescription drugs prices
canadian online pharmacies prescription drugs
canadian pharmacy meds
Quentinexext
April 18, 2019 at 12:19 am
Your comment is awaiting moderation.
You actually revealed this exceptionally well!
http://canadianpharmaciesnnm.com/
compare prescription prices canada drug drug price [url=http://canadianpharmaciesnnm.com/]global pharmacy canada[/url]
prescription drug cost
online canadian pharmacies
online pharmacy usa
best canadian pharmacies
drugs without prescription
discount pharmacy online
Quentinexext
April 18, 2019 at 12:37 am
Your comment is awaiting moderation.
Nicely put, With thanks!
http://www.canadianpharmacymsn.com/
best canadian prescription prices northwestpharmacy canadian drugstore reviews [url=http://canadianpharmaciescubarx.com/]canadian pharcharmy[/url]
drug price
best online pharmacy
buy prescription drugs without doctor
pharmacy canada
canadian family pharmacy
top rated online canadian pharmacies
Quentinexext
April 18, 2019 at 1:51 am
Your comment is awaiting moderation.
You said it adequately..
http://canadianpharmacysilo.com/
buy online prescription drugs top rated canadian pharmacies online canadian pharmacies online prescriptions [url=https://nicktambone.com/]canadian pharmaceuticals online[/url]
mexican pharmacy online medications
rx pharmacy
canadapharmacy com
no prescription online pharmacy
pharmacy canada
canada drugs pharmacy
Quentinexext
April 18, 2019 at 2:35 am
Your comment is awaiting moderation.
Helpful facts. Appreciate it.
http://canadianpharmacysilo.com/
drugstore online canada pharmacy online canadian online pharmacies prescription drugs [url=http://canadianpharmacysilo.com/]canadianpharmacy[/url]
meds online
candrugstore com
online prescription drugs
pharmacy canada
canada pharmacy online no script
canadian pharmacy 365
Quentinexext
April 18, 2019 at 3:05 am
Your comment is awaiting moderation.
You stated that superbly.
http://canadianpharmacysilo.com/
canadian drugstore online canada drugs no prior prescription required pharmacy [url=http://canadianpharmacymim.com/]canada drugs online[/url]
medication costs
prescription drug price comparison
best canadian mail order pharmacies
canadian pharmacy 365
visit poster’s website
canadian pharmacies online
Quentinexext
April 18, 2019 at 3:33 am
Your comment is awaiting moderation.
Superb facts. Thank you.
http://canadianpharmacyntx.com/
legitimate online pharmacies trust pharmacy canada buy drugs online [url=http://canadianpharmaciesnnm.com/]canadian pharmacies[/url]
buying drugs canada
pharmacy without dr prescriptions
canadian drugstore online
no 1 canadian pharcharmy online
cheap prescription drugs
canadian pharmacy viagra