6

I was reading this post on Slashdot which talks about the process of gathering evidence from a computer as part of an investigation. The post mentions being able to see the history of devices connected to a computer when doing forensics work, as well as which files were transferred to which devices:

But as we dig deeper, we'll begin to look at devices that were connected to the operating system. We'll match up the devices in our possession with the ones recorded by the os. We'll look for behavioral patterns of file movements from the OS to the device and then back.

Is it possible to see device history and which files were transferred to a given device when doing computer forensics? If so, which tools allow you to see this?

Improve this question
1

2 Answers 2

Reset to default
8

I can answer the first part. At least on Windows 7, you can see USB device history to some extent by viewing the Registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR

See the screenshot for an example of the content. This would allow you to confirm if a particular USB device had been connected to a particular computer.

I am not aware of any mechanism native to windows that would allow someone to view file transfer history to USB drives, and I'd be very interested to find out!

enter image description here

Improve this answer
4
  • Thanks scuzzy. Given the name of the registry branch is USBSTOR, I am guess it doesn't apply to firewire or eSATA devices? Or are they in a different part of the registry?
    – Sonny Ordell
    Commented Mar 15, 2012 at 5:32
  • I don't know of any equivalent history storage for firewire/eSATA devices, but I'm far from an authority on the subject :) Someone with more experience may be able to comment further.
    – scuzzy-delta
    Commented Mar 15, 2012 at 5:45
  • OK, thanks. Also, does this actually identify a USB device specifically, or only make and model?
    – Sonny Ordell
    Commented Mar 15, 2012 at 5:46
  • I believe the key name immediately below the make and model is a UID if the second character is not a "&". I would verify this experimentally though before relying on it for anything substantive.
    – scuzzy-delta
    Commented Mar 15, 2012 at 5:52
2

This tool (USB DView) allows you to pull a list of USB devices that have been attached to the computer at some stage by pulling the information mentioned in below answers and displaying it simply like so: From Nirsoft.net

For each USB device, extended information is displayed: Device name/description, device type, serial number (for mass storage devices), the date/time that device was added, VendorID, ProductID, and more... USBDeview also allows you to uninstall USB devices that you previously used, disconnect USB devices that are currently connected to your computer, as well as to disable and enable USB devices.

(Source as above)

For the other part of your question as to determining file transfer history, this depends on a number of things but utimately, operating systems don't generally store this much information as show in this answer. You can make modifications to your system in order to log such information but its not 'enabled by default'. I presume the reason why is because it would use up a huge amount of disk space in a very short time (if you copy millions of small files to a USB stick the logs will be enormous depending on the detail you are logging).

Improve this answer
1
  • Yeah. I've used this tool before. BT unsure of how the list of transfers can be found.
    – Arun Anson
    Commented Jan 6, 2016 at 4:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .