NDLI: USB Device Forensics: Insertion and removal timestamps of USB devices in Windows 8

Content Provider	IEEE Xplore Digital Library
Author	Deb, S.B. Chetry, A.
Copyright Year	2015
Description	Author affiliation: Kolkata Cyber Lab., Data Security Council of India (DSCI), Kolkata, India (Deb, S.B.) \|\| North Eastern Police Acad. (NEPA), Meghalaya, India (Chetry, A.)
Abstract	The timeline of the events surrounding an incident being investigated is one of the most important facets to forensic investigation. As a result, sometimes it is crucial to know when a suspect USB device might have been connected or disconnected from a system .A variety of forensic artifacts associated with the insertion and removal of USB devices are located in the windows registry, event logs etc. The existing forensically important locations, methodology and techniques for determining the traces left behind by the usage of USB devices in Windows XP, Vista and Windows 7 may not be the same for upcoming versions of Windows. This work aims to mainly study the forensic artifacts related to insertion and removal time stamps of various Mass Storage Class (MSC), Media Transport Protocol (MTP) and Picture Transport Protocol (PTP) enabled USB devices in Windows 8 operating system. In this paper the Windows 8 registry and Windows event logs were mainly considered as artifacts for analysis. This research explores forensic artifacts aimed to help a forensic investigator in enumerating the first insertion and last removal time stamps of various MSC, MTP and PTP enabled USB devices in Windows 8 computing environment by demonstrating the crucial Windows 8 registry keys , event logs and related metadata.
Starting Page	364
Ending Page	371
File Size	3292083
Page Count	8
File Format	PDF
ISBN	9781467367073
e-ISBN	9781467367080
DOI	10.1109/ISACC.2015.7377371
Language	English
Publisher	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Publisher Date	2015-09-14
Publisher Place	India
Access Restriction	Subscribed
Rights Holder	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Subject Keyword	USB devices Insertion and removal Media Forensic artifacts MTP Registry Object recognition PTP Event logs Windows 8 Universal Serial Bus MSC Forensic investigator Testing
Content Type	Text
Resource Type	Article

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

USB Artifact Analysis Using Windows Event Viewer, Registry and File System Logs

Windows registry forensics: an imperative step in tracking data theft via usb devices.

USB PassOn: Secure USB Thumb Drive Forensic Toolkit

Tracing USB Device artefacts on Windows XP operating system for forensic purpose Abstract

Forensic Analysis of the Windows 7 Registry

Forensic analysis of three social media apps in windows 10

A secure control protocol for USB mass storage devices

Logical data recovery technique for USB devices

An analysis of throughput characteristics of universial serial bus (1996)

USB Device Forensics: Insertion and removal timestamps of USB devices in Windows 8

Similar Documents

USB Artifact Analysis Using Windows Event Viewer, Registry and File System Logs

Windows registry forensics: an imperative step in tracking data theft via usb devices.

USB PassOn: Secure USB Thumb Drive Forensic Toolkit

Tracing USB Device artefacts on Windows XP operating system for forensic purpose Abstract

Forensic Analysis of the Windows 7 Registry

Forensic analysis of three social media apps in windows 10

A secure control protocol for USB mass storage devices

Logical data recovery technique for USB devices

An analysis of throughput characteristics of universial serial bus (1996)

USB Device Forensics: Insertion and removal timestamps of USB devices in Windows 8