Tracking USB storage: Analysis of windows artifacts generated by USB storage devices
H Carvey, C Altheide - Digital Investigation, 2005 - Elsevier
When a USB storage device, such as a thumb drive, is connected to a Windows system,
several identifiers are created on the system. These identifiers, or artifacts, persist even after
the system has been shut down. In many cases, these artifacts may be used for forensics
purposes to identify specific devices that have been connected to the Windows system (s) in
question.
several identifiers are created on the system. These identifiers, or artifacts, persist even after
the system has been shut down. In many cases, these artifacts may be used for forensics
purposes to identify specific devices that have been connected to the Windows system (s) in
question.
Showing the best result for this search. See all results