USB Artifact Analysis Using Windows Event Viewer, Registry and File System Logs

A USB mass storage device yields a lot of artifacts when connected to a system. These artifacts are persistent in nature and are retained even after the system has been shut down and the information they contain may assist in carrying out forensic analysis on a suspect system. In this paper, we demonstrate how Windows Event Viewer can be used to find forensic artifacts in a suspect system for investigative purposes. We also discuss the potential that Windows registry holds to identify USB devices’ information that have been connected to the system, to corroborate our findings from Windows Event Viewer. Finally, we use the Windows 10 file system to extract log details that contain the setup information of a USB device that was connected to the system the very first time, and obtain the necessary identifiers and time stamp details.

Download Full-text

EFFICIENT BIOMETRIC AND PASSWORD BASE MUTUAL AUTHENTICATION FOR CONSUMER USB MASS STORAGE DEVICE

International Journal of Advance Engineering and Research Development ◽

10.21090/ijaerd.76196 ◽

2017 ◽

Vol 4 (02) ◽

Keyword(s):

Mutual Authentication ◽

Storage Device ◽

Mass Storage ◽

Usb Mass Storage Device ◽

Mass Storage Device

Download Full-text

Anonymity preserving secure hash function based authentication scheme for consumer USB mass storage device

Proceedings of the 2015 Third International Conference on Computer, Communication, Control and Information Technology (C3IT) ◽

10.1109/c3it.2015.7060190 ◽

2015 ◽

Cited By ~ 8

Author(s):

Ruhul Amin ◽

G P Biswas

Keyword(s):

Hash Function ◽

Authentication Scheme ◽

Storage Device ◽

Mass Storage ◽

Usb Mass Storage Device ◽

Mass Storage Device

Download Full-text

Design of a USB OTG Mass Storage Module Based on LM3S9B90

Advanced Materials Research ◽

10.4028/www.scientific.net/amr.588-589.735 ◽

2012 ◽

Vol 588-589 ◽

pp. 735-738

Author(s):

Jie Zang ◽

Xiao Li Wang ◽

Zhong Hua Yan

Keyword(s):

Embedded Systems ◽

Storage Device ◽

Mass Storage ◽

Host System ◽

Storage Devices ◽

Usb Host ◽

Hardware System ◽

Usb Mass Storage Device ◽

Mass Storage Device ◽

Exchange Data

This paper introduces the method of design a USB On-The-Go (OTG) mass storage module according to USB 2.0 specification, which bases on embedded systems LM3S9B90. This module’s hardware system and software system is described, focusing on the implementation of USB host system. The module realizes USB OTG function, not only can realize functions of read and write USB mass storage devices, but also can exchange data with USB host as a USB mass storage device, can be used as an extension of USB system and has good application value.

Download Full-text