2

Is there a way to find out in which and/or how many computers a USB flash disk entered.
And if its possible can we find out how many times a file was read/edited.

I heard that its possible , but I cant find a program to do it.

  • What is your Operating system? – Kasun May 20 '14 at 12:14
  • Windows / Linux(Kali - Backtrack) – user46850 May 20 '14 at 12:15
  • Do you have access to specific workstations or only the USB? From the USB alone you will not find this, but some host OSes may leave trails or entries. USB devices, like iPods will record system identifiers because of syncing processes, but normally not a "standard" run of the mill usb device. – Eric G May 20 '14 at 18:48
  • 1
    A modern, high tech version of an age old question. – Tom Au May 20 '14 at 19:24
8

Removable devices including USB sticks don't store this information.

You can perhaps find some specific products which implement an auditing / logging technology to remember the number / type of devices it has been plugged in, but if your specific device don't implement it then you can't.

| improve this answer | |
  • And even if they do, it could be spoofed. – AJ Henderson May 20 '14 at 13:26
2

if you are using (most flavours of) Linux, then the /var/log/messages folder will keep a record of the device that was inserted.

May 20 16:04:44 c41111m kernel: usb 2-1: new high-speed USB device number 12 using xhci_hcd

May 20 16:04:45 c41111m kernel: [27978.113444] usb 2-1: New USB device found, idVendor=0781, idProduct=5151

May 20 16:04:45 c41111m kernel: [27978.113453] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3

May 20 16:04:45 c41111m kernel: [27978.113458] usb 2-1: Product: Cruzer Micro

May 20 16:04:45 c41111m kernel: [27978.113462] usb 2-1: Manufacturer: SanDisk

May 20 16:04:45 c41111m kernel: [27978.113466] usb 2-1: SerialNumber: 240103055311B652

See the serial number in the last entry. That's unique for a device with that make and model.

| improve this answer | |
  • 2
    I think he actually wants to check the information in the USB, instead of the machines it was inserted in. – Ay0 May 20 '14 at 16:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.