Monthly Archives: June 2014

Chrome – Basics

Google Chrome, or just Chrome, is (at the time of writing) the most popular web browser by a fair amount. Twice as popular as Mozilla’s Firefox. Chrome stores its artefacts in SQLite, JSON (JavaScript Object Notation) and SNSS (Session Saver) … Continue reading

Posted in Browser Forensics, Chrome, Google Chrome, Windows Forensics | Tagged , , , , , , , , , | Leave a comment

Internet Explorer – Basics

As IE comes bundled with Windows as standard it is often the browser (of choice?) used by a lot of organisations. Larger organisations are also often slower to update IE, in my experience, as they have integrated business critical applications … Continue reading

Posted in Browser Forensics, Internet Explorer, Windows Forensics | Tagged , , , , , , , | Leave a comment

Mozilla Firefox – Basics

Mozilla Firefox was the most popular back in 2011, and although its popularity has been surpassed by Google Chrome (which I will cover later), it still holds around a quarter of the internet’s browser base. With Windows 7 there were … Continue reading

Posted in Browser Forensics, Firefox | Tagged , , , , | Leave a comment

USB Forensics Final Part! (aka Pt. 7) Device first/last plugged in

The USB forensics thread can continue until the end of time, or at least the end of my free space on here, with this in mind I am only showing you the basics of USB forensics. I may cover more … Continue reading

Posted in USB Forensics, Windows Forensics, Windows Registry Forensics | Tagged , , , , | Leave a comment

USB Forensics Pt. 6 Which user account used the USB device

Having all this information is all well and good, but right now all we can say for sure is that a USB device was used on this machine. Just because someone logged on to that machine doesn’t make them the … Continue reading

Posted in USB Forensics, Windows Forensics, Windows Registry Forensics | Tagged , , , , | Leave a comment

USB Forensics Pt.5 Determine the Drive Letter

Finding the last Drive letter used by the USB device is actually quite simple…. or at least it should be! Go to the following Key: SYSTEM\MountedDevices Each drive letter is listed, however in my example on the VM the E: … Continue reading

Posted in USB Forensics, Windows Forensics, Windows Registry Forensics | Tagged , , , , | 1 Comment

USB Forensics Pt. 4 Volume Serial Number

On to Part 4 of our ongoing discoveries about USB forensics. A quick recap So far we have managed to get details of two devices which have been connected to our image. We have looked at how to get: Unique … Continue reading

Posted in USB Forensics, Windows Forensics, Windows Registry Forensics | Tagged , , , , | 1 Comment

USB Forensics Pt. 3 Discover the Volume Name

Part 3 of our investigation is to discover what the Volume Name of the USB device was. This can be helpful when looking into Link (.lnk) files (which I will cover in a later blog post). It can also occasionally … Continue reading

Posted in USB Forensics, Windows Forensics, Windows Registry Forensics | Tagged , , , , | 2 Comments

USB Forensics Pt. 2 Vendor ID (VID) & Product ID (PID)

In Part 1 we discussed how to find the Unique Serial Number ID for the USB devices historically connected to the device you are investigating. The next step is a simple one, finding the VID & PID (I say simple, … Continue reading

Posted in USB Forensics, Windows Forensics, Windows Registry Forensics | Tagged , , , , , | Leave a comment

USB Forensics Pt. 1 Serial Number

Forensicating USB devices can be a arduous task, as such I am going to break it down into byte (get it) size chunks. In order to get the Serial number from a USB device we must start our investigation on … Continue reading

Posted in USB Forensics, Windows Forensics, Windows Registry Forensics | Tagged , , , | Leave a comment