Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I originally came across this from a Citadel LLC complaint against a former employee. Text of complaint: http://www.scribd.com/doc/63606232/Citadel-vs-Yihao-Ben-Pu

From the filing:

"Forensic evidence has confirmed, however, that Pu also utilized a 500 gigabyte external hard drive (a Western Digital Elements 1023)"

How does one actually find out if a user connected an external hard drive?

share|improve this question
    
what os? it would depend. –  Journeyman Geek Sep 2 '11 at 1:32
    
@Journeyman Geek yes, its for windows :) –  Foo Bah Sep 2 '11 at 2:23
add comment

2 Answers

up vote 4 down vote accepted

On windows, its stored in the registry - usually HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR enter image description here

I'd also look at setupapi.log on %windir% for driver installs on systems older than windows 7 (its supposed to be %windir%\INF\setupapi.dev.log and %windir%\INF\setupapi.app.log , but the forensics classes i went to totally totally ignored this location, so i'm not totally familiar with this) - if a driver is there, and its device is not in the registry, you know that something is off.

I'd refer you to this article on antiforensics which i used to refresh my memory on where exactly it is.

share|improve this answer
    
is there a way to insert a usb device while bypassing this mechanism? –  Foo Bah Sep 2 '11 at 2:23
    
@Foo Bah, not really. Windows needs to mount and load drivers to use the device. When it does this, it records information about the device so that it can load the device faster the next time. Remember, Windows is not an OS specifically designed for anonymous usage; it is meant for legitimate users who expect to reuse their devices on their systems. –  Synetech Sep 2 '11 at 3:09
add comment

If a USB device is connected and is mounted in Windows it is recorded in the Windows registry.

You can use USBDeview to see any USB device ever connected to any PC you run it on. It pulls the information from the Windows Registry.

USBDeview is a small utility that lists all USB devices that currently connected to your computer, as well as all USB devices that you previously used.For each USB device, extended information is displayed: Device name/description, device type, serial number (for mass storage devices), the date/time that device was added, VendorID, ProductID, and more.

USBDeview also allows you to uninstall USB devices that you previously used, disconnect USB devices that are currently connected to your computer, as well as to disable and enable USB devices. You can also use USBDeview on a remote computer, as long as you login to that computer with admin user.

Only way around this is to manually remove all entries from the registry that refer to that specific device, along with other Windows locations mentioned by Journeyman Geek. USBDeview uninstall feature may not remove all traces of the device in the registry.

share|improve this answer
    
that is a very nifty tool! –  Foo Bah Sep 2 '11 at 3:19
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.