Skip to content
USBForensics

Posts tagged: #dfir

← Back to all posts
USB Exfiltration Investigation: A Worked Example
A fictional intrusion walked through with USB Forensics: find the stick, confirm when it was connected, attribute the account and list the files copied.
usb-forensicsinvestigationexfiltrationdfir
USB Device Forensics on Windows: The Complete Map
Every Windows artifact that records a USB stick — registry, setupapi.dev.log, event logs, LNK, Jump Lists, ShellBags — and how to tie them to one device.
usb-forensicsregistryevent-logsdfir