SANS Digital Forensics and Incident Response Blog: Tag - USBKEY Analysis

Computer Forensic Guide To Profiling USB Device Thumbdrives on Win7, Vista, and XP

Several times over the past year it has come up in a discussion about the key differences between examining USB Key/Thumbdrives on XP, VISTA, and Windows 7. We did an initial post several weeks ago, but found some new information and have updated our guides as a result. Thanks to SANS Digital Forensic Instructor Colin Cree for the wonderful feedback.

As a part of the SEC408: Computer Forensic Essentials course, we have an extensive section on residue left by USB Devices. I am providing a single guides to help you answer the key USB Key/Thumbdrive questions for your case covering XP, VISTA, and Win7.

Digital Forensic SIFT'ing: Registry and Filesystem Timeline Creation

by Rob Lee

Over the years, being able to examine filesystem timeline data has truly been a breakthrough for many investigations. We started using this technique when we were working on cases in the AFOSI very early on when I wrote a script that would create a basic timeline called based off of the original coroner's toolkit. To my surprise, this key forensic capability that is found in the TCT tools, sleuthkit, andothershas not been picked up on by the major forensic vendors as a capability in their toolsets such as EnCase and FTK.

Today's post will discuss how to create a windows operating system timeline of both filesystem and registry data using the SIFT Digital Forensics Workstation.

What is computer