Mini-Module
Summary
The USB Forensics module is designed for digital forensics professionals seeking specialization in USB forensics and Cybersecurity professionals interested in enhancing their skills in USB-related investigations. Throughout this module, students will develop expertise in USB forensics, mastering data extraction, analysis, and investigative techniques and acquire practical skills in forensic imaging, and artifact identification through real-world case studies and hands-on exercises.
Recommended prior knowledge:
- Basic knowledge of digital forensics principles
Introduction to USB Forensics
Universal Serial Bus(USB) flash drives, commonly known as USB flash drives are the most common storage devices that can be found as evidence in Digital Forensics Investigations. Using USB and external drives in the workplace may let nasty users remove/exfiltrate sensitive or confidential information from a system without any authorization. To resolve this issue, forensic examination of systems comes into the picture.
In this module, we will discuss how USBs can be used as evil and pose a threat to your organization. We'll delve into the forensic analysis of USBs, exploring methods to uncover comprehensive data and contextual information related to the use of USB devices on Windows systems. We will discuss how to find timestamps indicating the initial connection, last connection, and disconnection of the USB to help create a forensic timeline for the incident. We will also look through different kinds of native event logs that can be leveraged as evidence in incidents. Finally, we will discuss how to find the interacted files, how they are placed in the USB, and the USB devices' full paths to understand the suspect user's motivations.
