Skip to content
USBForensics

Series

Investigating USB activity

2 posts in this series. Read them in order or jump to any one.

  1. Which Files Were Opened From a USB Stick? LNK, Jump Lists

    Tie shortcuts, Jump Lists, ShellBags and 4663 events to a physical USB device with volume serial numbers, drive letters and time, and name the user.

  2. USB Exfiltration Investigation: A Worked Example

    A fictional intrusion walked through with USB Forensics: find the stick, confirm when it was connected, attribute the account and list the files copied.

All posts in this series

Which Files Were Opened From a USB Stick? LNK, Jump Lists
Tie shortcuts, Jump Lists, ShellBags and 4663 events to a physical USB device with volume serial numbers, drive letters and time, and name the user.
usb-forensicslnkjump-listsshellbags
USB Exfiltration Investigation: A Worked Example
A fictional intrusion walked through with USB Forensics: find the stick, confirm when it was connected, attribute the account and list the files copied.
usb-forensicsinvestigationexfiltrationdfir