Forensics
USB devices with internal memory Jul 02 2007 05:43PM
Michael Edwards (medwards digital-legal com)
Greetings to the list -

Lately, I've been working with a few devices that contain internal
flash memory for storage. The existing drivers for these devices do
not mount them as a drive - in some cases, they seem to use slightly
modified USB drivers specifically to keep you from accessing them as such.

For example: digital voice recorders; cameras that contain internal
flash memory.

With items like flash memory cards/sticks/drives, as they present
themselves as a drive to the Windows OS, they are easily imaged by,
say, FTK imager - and it is similarly easy to recover deleted items
(or, at the very least, view the contents of the memory space). The
devices I've mentioned, while having internal memory that allows one
to write files to it, and having USB interfaces, require proprietary
drivers and software to access them.

Ideally, I'd love a Windows based solution, but any solution would be
welcomed. How do folks handle such devices? Just image what you can
(via the propriety software), or have you used other methods?

--
Michael Edwards

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus