Forensic Analysis of USB Artifacts

Universal Serial Bus (USB) devices are ubiquitous in our daily lives and have become essential in transferring data between devices. With this convenience comes the potential for misuse, whether accidental or intentional. USB devices have been used in cyberattacks to deliver malware, steal sensitive information, and exfiltrate data from compromised systems. As digital forensic investigators, it’s crucial to have a thorough understanding of USB devices and how to analyze them.

The analysis of removable devices, such as USB devices, has become increasingly important in digital forensics investigations. With the rise of remote work and the use of personal devices, USB devices have gained widespread popularity for seamless data transfer between devices. Nonetheless, this convenience brings along an inherent security risk, as USB devices can potentially serve as carriers for malware delivery or data exfiltration from compromised systems. Also...

Technical requirements

Windows registry analysis requires certain technical requirements to ensure that the process is executed efficiently and effectively. For this chapter, you need Registry Explorer, which can be downloaded from https://ericzimmerman.github.io/#!index.md.

Overview of USB devices and types

The USB Mass Storage Class (USB MSC) is a collection of communication protocols defined by the USB Implementers Forum. These protocols establish a standard for USB devices to be recognized and accessed by host computing devices, facilitating file transfer between the host and the USB device. When a USB device operates in MSC mode, it emulates the functionality of an external hard drive, allowing the host system to interact with it as if it were a traditional storage device. This protocol set enables compatibility with various storage devices, ensuring seamless data exchange between the host and the USB device.

Some common USB artifacts that can be analyzed in Windows include the following:

• Registry keys: When a USB device is plugged into a Windows system, it creates various registry keys that can be analyzed to determine information such as the device’s serial number, its manufacturer, and timestamps indicating when the device was...

Understanding stored evidence on USB devices

Let’s dive into MTP and find out more about it. On personal computers, we often come across USB device classes known as MTP and PTP. These protocols are commonly utilized by a range of devices, including mobile phones, tablets, cameras, scanners, and music players. Unlike standard storage devices that fall under MSC, MTP and PTP offer a subset of capabilities. Consequently, the operating system treats them differently, recognizing their unique characteristics and functionalities. To identify a USB device we can check SYSTEM\<CurrentControlSet>\Enum\USB and SOFTWARE\Microsoft\Windows Portable Devices\Devices.

On the other hand, MSC is a transfer protocol that facilitates communication between a computer and a USB device. It enables the mounting of the USB device’s storage area, granting direct access to these data areas for reading and writing. This allows users to conveniently view the internal filesystem structure...

Analyzing USB artifacts

Analyzing USB artifacts in Windows forensics involves examining the various traces and evidence left behind by USB devices and their interactions with the Windows operating system. USB artifacts can provide valuable insights into device connections, usage patterns, and potentially relevant information for forensic investigations. Here are some key aspects of analyzing USB artifacts in Windows forensics:

• Registry analysis: The Windows registry is a central database that stores configuration settings and information about connected hardware devices. In the context of USB artifacts, forensic analysts focus on specific registry keys such as USBSTOR, Enum\USB, and MountedDevices. These keys contain valuable information about connected USB devices, including their unique identifiers, vendor and product IDs, serial numbers, and timestamps of device connections and removals. Analyzing these registry keys can provide insights into the history of connected USB...

Exploring a real-world scenario of identifying the root cause

The cybersecurity team reported an alert triggered on hostname (DESKTOP-T7HCR2I) for a malicious hacking tool, and during the investigation, the team could not identify the root cause. As digital forensic examiners, we are now tasked with identifying the source of the malicious binary and reporting back to the cybersecurity team.

One of the things we check during such an incident is what log source types we have and how we can find our evidence to map it for the current incident. Since we are focusing on Windows artifacts, we need a way to pull the triage image over the network or we can perform that locally. In the real world, usually, we use tools such as endpoint detection and response to access the endpoint directly and collect the desired artifacts. However, in our lab scenario, we will perform manual collection using KAPE, as we covered it in Chapter 2.

By running the following KAPE script, we will collect our...

USB artifacts analysis exercises

In this section, we will apply what we have learned so far:

1. Using the Windows registry, identify the letter assigned to a recently plugged-in USB device on your home computer.
2. Validate the serial number and vendor ID of the USB device.
3. By using the USBDeview tool, explore the installed and plugged-in USB devices on your local machine.

Summary

In conclusion, USB forensic analysis plays a crucial role in modern digital investigations. The examination of USB artifacts provides valuable insights into the usage, history, and interactions of USB devices within a system. By leveraging forensic techniques and tools, investigators can uncover critical evidence related to data breaches, intellectual property theft, and other malicious activities involving USB devices.

Throughout this chapter, we have explored various aspects of USB forensic analysis. We discussed the significance of USB artifacts as a rich source of evidence, including device information, timestamps, and file transfer activities. We examined the importance of understanding different USB protocols, such as MTP and MSC, which enable the transfer of data between USB devices and host systems.

Moreover, we delved into the analysis of USB artifacts in Windows, exploring key registry locations and files that store valuable information about connected USB devices...