Article ID Journal Published Year Pages File Type
10341969 Digital Investigation 2005 7 Pages PDF
Abstract
When a USB storage device, such as a thumb drive, is connected to a Windows system, several identifiers are created on the system. These identifiers, or artifacts, persist even after the system has been shut down. In many cases, these artifacts may be used for forensics purposes to identify specific devices that have been connected to the Windows system(s) in question.
Related Topics
Physical Sciences and Engineering Computer Science Computer Networks and Communications
Preview
Tracking USB storage: Analysis of windows artifacts generated by USB storage devices
Authors
, ,