Tracking USB storage: Analysis of windows artifacts generated by USB storage devices

Authors:
Harlan Carvey;Cory Altheide
Affiliations:
-;-
Venue:
Digital Investigation: The International Journal of Digital Forensics & Incident Response
Year:
2005

Citing 0
Cited 4

The design of framework for detecting an insider's leak of confidential information

Proceedings of the 1st international conference on Forensic applications and techniques in telecommunications, information, and multimedia and workshop
Forensic Extraction of EFS-Encrypted Files in Live System Investigation

Journal of Digital Forensic Practice
Secure USB bypassing tool

Digital Investigation: The International Journal of Digital Forensics & Incident Response
Detecting data theft using stochastic forensics

Digital Investigation: The International Journal of Digital Forensics & Incident Response

Quantified Score

Hi-index	0.00

Visualization

Abstract

When a USB storage device, such as a thumb drive, is connected to a Windows system, several identifiers are created on the system. These identifiers, or artifacts, persist even after the system has been shut down. In many cases, these artifacts may be used for forensics purposes to identify specific devices that have been connected to the Windows system(s) in question.