Forensics
Re: Tracking moved files? Nov 08 2006 04:01PM
bsmathers reypd com
This is all done within the registry and not a log file unless some third party synchronization software was used. There are unique descriptors created for each device that lists information like what kind of device it is, number of endpoints, etc.

You can read more about descriptors here:

http://www.beyondlogic.org/usbnutshell/usb5.htm

To get more information on the device itself, check out these keys:

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC
\Volume
HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR

To get more information on files check out the Most Recently Used (MRU) keys:

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSav
eMRU
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVis
itedMRU
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU

Also:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs

I would check these areas and see if any files match up to the location/device of the USB flash drive in question. Hopefully the ?clear list? feature isn?t selected for the recent opened documents. If so, it could clear the locations above.

Another area I would check is the information within the virtual memory, as well as the memory management key within the registry since it holds the virtual memory configuration:

HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management

Helpful tools:

UVCView
http://www.microsoft.com/whdc/device/stream/vidcap/UVCview.mspx

USB Vendor ID List:
http://www.linux-usb.org/usb.ids

USB Specification ? download the latest version. Check out section 9.5, 9.6, and 9.7 http://www.usb.org/developers/docs

As for the post about the DLT Service?. I believe that just monitors NTFS volumes and since most flash drives like USB drives are FAT32, I am not sure if the DLT client service will be much help. Still, maybe worth a look though.

Good luck!

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus