4

I have an image of an SD card and I am doing analysis on it. Is there any way to find that on which system this SD card was used last time.

The image I am having is of a SDHC and has FAT32 as file system.

does SD card saves the System information of the system in which they were connected or mounted.

  • there is a possibility to get the info going backwards: windows caches the media serials. – dandavis Apr 24 '17 at 22:18
  • Yeah, We can get the information if we have access to the system. We can use Registry keys like USB, USBSTOR, MountedDevices and all to map the USB drives or memory card used on that particular system. But in this case I just have the forensics image of the memory card. So I was just thinking if there is any way to find the system information from this image. – Blaze Apr 25 '17 at 2:05
2

AFAIK, there isn't a reliable, universal way to detect the last device a usb drive was plugged into. The best you can do is infer it from the modification times of system-specific file metadata (e.g. thumbs.db on Windows, .DS_Store on Mac) or recycle bin folders ($Recycle.Bin on Windows, .Trash-xxxx on some Linuxes).

  • Thankx, yeah the problem is the memory card is not having any system specific metadata file. The card contains some word and xlsx files.is it possible to determine the information about the system using the metadata of these files. – Blaze Apr 24 '17 at 11:03
  • @Blaze: docx and xlsx usually saves the name of the last account that modifies the file in the docProps/core.xml inside the docx/xlsx file. However, this can be trivially spoofed and it may not record them if you don't modify the file. – Lie Ryan Apr 24 '17 at 11:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.