Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Identify if data was saved to USB disk?


  • Please log in to reply
16 replies to this topic

#1 Bunny-Gee

Bunny-Gee

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:12:38 AM

Posted 14 December 2016 - 01:07 PM

Data has been "lost" from one of my networked PC's.

I have analysed the hard drive & that of the shared Server and "recovered" deleted or otherwise "lost" files. This appears to have worked inasmuch that it recovered data which had been deleted over a considerable period of time before and after the "lost" data was created, yet there is no sign whatsoever of the lost data having been saved to the drives.

Perhaps the data might have been saved to a USB stick, rather than the hard drive or Server and I am wondering if (and if so, how difficult is it) evidence can be obtained which would show the date and time a USB drive has been employed and (even better) whether such might detail the contents (or at least the filenames and types) of data that was saved in this way?

Would Windows event viewer reveal any or all of this and how would we go about isolating USB drive activity etc., through this means, if so?

 

Or is there another software utility which might help?

Any advice gratefully received, please? 

 

 Many thanks.  :mellow:



BC AdBot (Login to Remove)

 


#2 Didier Stevens

Didier Stevens

  • BC Advisor
  • 2,717 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:02:38 AM

Posted 14 December 2016 - 02:07 PM

Information is recorded in the registry and log files when USB removable storage is first connected to a Windows machine:

http://www.forensicswiki.org/wiki/USB_History_Viewing

 

But there are no records of files written to USB stick.


Didier Stevens
http://blog.DidierStevens.com
http://DidierStevensLabs.com

SANS ISC Senior Handler
Microsoft MVP 2011-2016 Consumer Security, Windows Insider MVP 2016-2019
MVP_Horizontal_BlueOnly.png

 

If you send me messages, per Bleeping Computer's Forum policy, I will not engage in a conversation, but try to answer your question in the relevant forum post. If you don't want this, don't send me messages.

 

Stevens' law: "As an online security discussion grows longer, the probability of a reference to BadUSB approaches 1.0"


#3 JohnC_21

JohnC_21

  • Members
  • 24,438 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:08:38 PM

Posted 14 December 2016 - 02:11 PM

This Utility may help.

 

http://orionforensics.com/w_en_page/USB_forensic_tracker.php

 

Edit: USBdview may also help

 

http://www.nirsoft.net/utils/usb_devices_view.html


Edited by JohnC_21, 14 December 2016 - 02:18 PM.


#4 RolandJS

RolandJS

  • Members
  • 4,533 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Austin TX metro area
  • Local time:07:38 PM

Posted 14 December 2016 - 02:24 PM

When I worked for my dad, his network guru, using Novell, was able to keep some sort of log of what happened on the network [How detailed the copy/move/delete record, dunno, never saw the logs].  I'm not sure if Windows server-level OS can do likewise.


Edited by RolandJS, 14 December 2016 - 02:25 PM.

"Take care of thy backups and thy restores shall take care of thee."  -- Ben Franklin revisited.

http://collegecafe.fr.yuku.com/forums/45/Computer-Technologies/

Backup, backup, backup! -- Lady Fitzgerald (w7forums)

Clone or Image often! Backup... -- RockE (WSL)


#5 Bunny-Gee

Bunny-Gee
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:12:38 AM

Posted 14 December 2016 - 03:32 PM

Thanks.

 

Does that mean that each USB will only be logged on the first occasion it is plugged in. If I plugged a USB in once and then plugged it in again, later the same day (or later the same YEAR), would it not be logged, as it had been plugged in and registered previously (on its first occasion)?

 

Information is recorded in the registry and log files when USB removable storage is first connected to a Windows machine:

http://www.forensicswiki.org/wiki/USB_History_Viewing

 

But there are no records of files written to USB stick



#6 Bunny-Gee

Bunny-Gee
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:12:38 AM

Posted 14 December 2016 - 03:34 PM

Thank you. I'll give those a whirl. :-)



#7 Didier Stevens

Didier Stevens

  • BC Advisor
  • 2,717 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:02:38 AM

Posted 14 December 2016 - 04:18 PM

It's explained in the link I posted.

First connection is logged in the log file, time & date last connection is lastwrite timestamp of the registry key.


Didier Stevens
http://blog.DidierStevens.com
http://DidierStevensLabs.com

SANS ISC Senior Handler
Microsoft MVP 2011-2016 Consumer Security, Windows Insider MVP 2016-2019
MVP_Horizontal_BlueOnly.png

 

If you send me messages, per Bleeping Computer's Forum policy, I will not engage in a conversation, but try to answer your question in the relevant forum post. If you don't want this, don't send me messages.

 

Stevens' law: "As an online security discussion grows longer, the probability of a reference to BadUSB approaches 1.0"


#8 RolandJS

RolandJS

  • Members
  • 4,533 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Austin TX metro area
  • Local time:07:38 PM

Posted 14 December 2016 - 04:55 PM

Information is recorded in the registry and log files when USB removable storage is first connected to a Windows machine..  -- Didier Stevens

 

Does that mean that each USB will only be logged on the first occasion it is plugged in. If I plugged a USB in once and then plugged it in again, later the same day (or later the same YEAR), would it not be logged, as it had been plugged in and registered previously (on its first occasion)? -- Thread Starter

 

I think what D. Stevens meant is that the logging starts the moment the usb stick is inserted, the logging stops the moment the usb stick is removed.  Each such inserted-used-then-removed session is recorded. -- me


Edited by RolandJS, 14 December 2016 - 04:58 PM.

"Take care of thy backups and thy restores shall take care of thee."  -- Ben Franklin revisited.

http://collegecafe.fr.yuku.com/forums/45/Computer-Technologies/

Backup, backup, backup! -- Lady Fitzgerald (w7forums)

Clone or Image often! Backup... -- RockE (WSL)


#9 Bunny-Gee

Bunny-Gee
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:12:38 AM

Posted 16 December 2016 - 08:27 AM

It's explained in the link I posted.

First connection is logged in the log file, time & date last connection is lastwrite timestamp of the registry key.

Thanks, both downloads worked. The most thorough seems to be the Forensic one although it does only log first and last time a device was used. I was hoping it would record every time a USB was used.

 

Not to worry, the info is quite helpful, anyway.

 

Thanks again. :-)



#10 Bunny-Gee

Bunny-Gee
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:12:38 AM

Posted 16 December 2016 - 08:29 AM

 

Information is recorded in the registry and log files when USB removable storage is first connected to a Windows machine..  -- Didier Stevens

 

Does that mean that each USB will only be logged on the first occasion it is plugged in. If I plugged a USB in once and then plugged it in again, later the same day (or later the same YEAR), would it not be logged, as it had been plugged in and registered previously (on its first occasion)? -- Thread Starter

 

I think what D. Stevens meant is that the logging starts the moment the usb stick is inserted, the logging stops the moment the usb stick is removed.  Each such inserted-used-then-removed session is recorded. -- me

 

No, only the first and last time a USB is used, unfortunately.



#11 RolandJS

RolandJS

  • Members
  • 4,533 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Austin TX metro area
  • Local time:07:38 PM

Posted 16 December 2016 - 09:56 AM

..."No, only the first and last time a USB is used, unfortunately..."  To me, that means any successive insertion/removal session for that particular Windows session is not recorded - thanks for the clarification!  :)


"Take care of thy backups and thy restores shall take care of thee."  -- Ben Franklin revisited.

http://collegecafe.fr.yuku.com/forums/45/Computer-Technologies/

Backup, backup, backup! -- Lady Fitzgerald (w7forums)

Clone or Image often! Backup... -- RockE (WSL)


#12 rp88

rp88

  • Members
  • 3,060 posts
  • OFFLINE
  •  
  • Gender:Not Telling
  • Local time:12:38 AM

Posted 16 December 2016 - 11:59 AM

If you are trying to recover data from a USB you don't stand much chance. unlike a hard-drive where deletion just gets rid of the records that say where the data is stored on the hard-drive (and the file persists until the bits of the drive it is on get over-written) data on a USB is completely gone the moment it is erased because of the way in which flash memory works.
Back on this site, for a while anyway, been so busy the last year.

My systems:2 laptops, intel i3 processors, windows 8.1 installed on the hard-drive and linux mint 17.3 MATE installed to USB

#13 JohnC_21

JohnC_21

  • Members
  • 24,438 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:08:38 PM

Posted 16 December 2016 - 12:08 PM

If you are trying to recover data from a USB you don't stand much chance. unlike a hard-drive where deletion just gets rid of the records that say where the data is stored on the hard-drive (and the file persists until the bits of the drive it is on get over-written) data on a USB is completely gone the moment it is erased because of the way in which flash memory works.

Some flash drives are detected as HDD's and not removable drives. Earlier Sandisk Cruzer Glide's acted like a HDD. If this is the case when the file is selected for deletion it will go to the recycle bin.

 

If you delete data from a USB flash drive detected as a removable device you have a good chance of recovery with a program like Testdisk. I deleted a number of files from a flash drive and recovered them all with Testdisk. 


Edited by JohnC_21, 16 December 2016 - 12:30 PM.


#14 Bunny-Gee

Bunny-Gee
  • Topic Starter

  • Members
  • 8 posts
  • OFFLINE
  •  
  • Local time:12:38 AM

Posted 16 December 2016 - 12:47 PM

If you are trying to recover data from a USB you don't stand much chance. unlike a hard-drive where deletion just gets rid of the records that say where the data is stored on the hard-drive (and the file persists until the bits of the drive it is on get over-written) data on a USB is completely gone the moment it is erased because of the way in which flash memory works.

 

 

 

If you are trying to recover data from a USB you don't stand much chance. unlike a hard-drive where deletion just gets rid of the records that say where the data is stored on the hard-drive (and the file persists until the bits of the drive it is on get over-written) data on a USB is completely gone the moment it is erased because of the way in which flash memory works.

Some flash drives are detected as HDD's and not removable drives. Earlier Sandisk Cruzer Glide's acted like a HDD. If this is the case when the file is selected for deletion it will go to the recycle bin.

 

If you delete data from a USB flash drive detected as a removable device you have a good chance of recovery with a program like Testdisk. I deleted a number of files from a flash drive and recovered them all with Testdisk. 

 

Thanks, but I think you guys misunderstand.

 

Not trying to retrieve data from a USB drive, just a log containing information pertaining to (all, if possible) occasions when a USB disk was mounted/ejected to/from a Windows based PC.

 

But thanks for the useful info, anyway :-)



#15 Didier Stevens

Didier Stevens

  • BC Advisor
  • 2,717 posts
  • OFFLINE
  •  
  • Gender:Male
  • Local time:02:38 AM

Posted 18 December 2016 - 05:34 PM

Each time a USB stick is inserted, data is written to the registry. The data written to the registry does not include a timestamp.

However, registry keys have a "Last Write Time" property. Each time registry values are written, the "Last Write Time" property of the registry key containing these values, is updated with the current time.

 

This is what allows these tools to report the last time a usb stick was inserted.

 

The setupapi.log file contains an entry when a usb stick was inserted for the first time.


Edited by Didier Stevens, 18 December 2016 - 05:35 PM.

Didier Stevens
http://blog.DidierStevens.com
http://DidierStevensLabs.com

SANS ISC Senior Handler
Microsoft MVP 2011-2016 Consumer Security, Windows Insider MVP 2016-2019
MVP_Horizontal_BlueOnly.png

 

If you send me messages, per Bleeping Computer's Forum policy, I will not engage in a conversation, but try to answer your question in the relevant forum post. If you don't want this, don't send me messages.

 

Stevens' law: "As an online security discussion grows longer, the probability of a reference to BadUSB approaches 1.0"





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users