While internet connected ovens, smart doorbells, and fridge cams were all the rage at this year’s CES show, USB’s are still all the rage for anyone looking to store data in an easy-to-carry, remote fashion. Portable digital device usage has seen exponential growth, increasing in parallel to the use of consumer electronics. Flash memory technology, especially USB drive technology, has dominated the storage industry due to ease of use and accessibility.
We now see USB thumb drives up to 1 terabyte, allowing people to store enormous amounts of data on a user-friendly device. Additionally, new solid-state-drives (SSD) can be up to 2 terabytes, while external USB’s containing traditional spinning drives can be as large as 8 terabytes.
USB-based memory storage devices are an easy means of collecting and storing both legitimate and unlawful data, e.g. stolen company information, wiping software tools, or malware. Due to their capacity and popularity of use, USB devices are an important source of evidence for investigations.
I, along with my colleagues at iDS, am frequently called upon to preserve, analyze, and report on USB device connectivity history on computer systems. Artifacts in the computer’s registry allow examiners to see when a device was first attached and last attached to the system. The use of artifacts from link files and jump lists can also show what documents were opened from USB storage devices. This helps investigators identify additional devices that need to be collected for further inspection.
Portable storage does not just come in the form of thumb drives or external drives. It can also include SD cards and micro SD cards. These are small, flash based storage and have capacities up to 256 gigabytes. This capacity allows users to store thousands of documents on a device that is smaller than a quarter, so easily concealable. As technology moves forward, we will see larger and larger storage capacity available in smaller and smaller devices.
The Forensicators are always on the lookout for new ways users are storing and transferring data. As many Android users know, there are devices which will let you connect a micro SD card to your phone, allowing one to store and transfer large amounts of digital data.
If you are concerned about data exfiltration or misuse, the experts at iDS can help uncover which USB storage devices were used, when they were first and last accessed or altered, and, in many cases, what documents they held. This type of forensic expertise can make the difference in many cases, including theft of IP and trade secret issues. Contact me at firstname.lastname@example.org to learn more about how iDS’ Forensics Team can leverage USB data in your next case or investigation.
To access previous blog posts from iDS, please CLICK HERE.
Please email Mr. Garcia at email@example.com to discuss USB collection and analysis, additional digital forensics services, as well as how the experts at iDS can assist with all your legal technology or expert testimony needs on your next case or internal investigation.
The opinions reflected in this post are solely those of the author, are for educational purposes to provide general information, and do not necessarily represent the views of iDiscovery Solutions (iDS), nor any current or former employee of iDS. Moreover, any references to specific litigation or investigation work or findings are fact-specific. This blog should not be used as a substitute for competent legal advice.
Download Keys to Today’s Information Governance Landscape