Category Archives: USB Forensics

USB Forensics Pt. 3 Discover the Volume Name

Posted on June 7, 2014 by HatsOffSecurity

Part 3 of our investigation is to discover what the Volume Name of the USB device was. This can be helpful when looking into Link (.lnk) files (which I will cover in a later blog post). It can also occasionally … Continue reading →

Posted in USB Forensics, Windows Forensics, Windows Registry Forensics | Tagged , , , , | 2 Comments

USB Forensics Pt. 2 Vendor ID (VID) & Product ID (PID)

Posted on June 7, 2014 by HatsOffSecurity

In Part 1 we discussed how to find the Unique Serial Number ID for the USB devices historically connected to the device you are investigating. The next step is a simple one, finding the VID & PID (I say simple, … Continue reading →

Posted in USB Forensics, Windows Forensics, Windows Registry Forensics | Tagged , , , , , | Leave a comment

USB Forensics Pt. 1 Serial Number

Posted on June 5, 2014 by HatsOffSecurity

Forensicating USB devices can be a arduous task, as such I am going to break it down into byte (get it) size chunks. In order to get the Serial number from a USB device we must start our investigation on … Continue reading →

Posted in USB Forensics, Windows Forensics, Windows Registry Forensics | Tagged , , , | 1 Comment