Cyber Forensics up and Running by Vashishth Tarun;

Author:Vashishth, Tarun;
Language: eng
Format: epub
Publisher: BPB Publications

In all of these examples, USB drives were used as a delivery mechanism for malicious software or as a means of accessing sensitive systems. The use of USB drives allowed attackers to bypass traditional security measures and gain access to critical systems or data. In many cases, the use of USB drives was discovered through forensic analysis or by tracing the attack back to its source.

We will look at how Windows registry keys can help digital forensics professionals and incident responders to identify whether an USB or thumb drive or even an external drive was either plugged or mounted to the system. If yes, then when and which USB or thumb drive.

Registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR. It stores information about USB storage devices connected to the system, including device name, vendor ID, product ID, and serial number.

There are a few more USB-related registry keys which store a great wealth of information, as discussed in the following table:

Registry Key

Description

Download

Copyright Disclaimer:
This site does not store any files on its server. We only index and link to content provided by other sites. Please contact the content providers to delete copyright contents if any and email us, we'll remove relevant links or contents immediately.