# Introduction to USB Forensics

## **Introduction**

While USB devices are invaluable for data transfer, they also pose significant security risks. Malicious actors or insiders may leverage USB drives to **exfiltrate sensitive data**, introduce **malware**, or **bypass security controls**. USB forensics involves examining USB activity on a system to uncover evidence, establish timelines, and assess the scope of security breaches.

***

## **Why USB Forensics is Important**

1. **Data Exfiltration**:
   * USB drives are frequently used for unauthorized data transfers, bypassing network monitoring.
2. **Malware Introduction**:
   * USB devices can serve as a vector for **malware**, including **worms**, **ransomware**, or other payloads.
3. **Evidence Collection**:
   * In cases of **insider threats** or **policy violations**, USB forensics identifies unauthorized activity, enabling accountability.

***

## **Key Forensic Goals**

### **1. Identify USB Usage**

* **Device Detection**: Determine which USB devices were connected and when.
* **User Identification**: Correlate device usage with specific user accounts.

### **2. Establish Timelines**

* **Connection Events**:
  * First connection.
  * Last connection.
  * Disconnection times.
* Correlate these events with other system logs to establish an incident timeline.

### **3. File Interaction Analysis**

* Identify **files accessed**, **copied**, or **modified** on the USB device.
* Locate **deleted** or **hidden files**.

### **4. Device Metadata**

* Gather **device-specific information**, such as:
  * **Serial numbers**.
  * **Manufacturer details**.
  * **Volume labels**.
* Identify unique USB devices, even if renamed or reformatted.

***

## **Sources of USB Forensic Evidence**

### **1. Registry Artifacts**

The Windows Registry stores valuable data about connected USB devices:

* **Key Registry Locations**:
  * `SYSTEM\CurrentControlSet\Enum\USBSTOR`: Device information and serial numbers.
  * `SYSTEM\CurrentControlSet\Services\USBSTOR`: Tracks driver usage for USB storage.
  * `SYSTEM\MountedDevices`: Records drive letters assigned to USB devices.

### **2. Event Logs**

* **Security Logs**:
  * **Event ID 4663**: Tracks file access.
  * **Event ID 4656**: Tracks object creation.
* **System Logs**:
  * **Event ID 20001**: USB device connection under `Microsoft-Windows-DriverFrameworks-UserMode`.
* **Application Logs**:
  * Logs from specific applications interacting with USB devices.

### **3. Volume Shadow Copies**

* **Volume Shadow Copies** may contain snapshots of USB file systems, even if files were deleted.

**4. $LogFile and $MFT (Master File Table)**

* These artifacts track **file operations** on USB devices, providing insight into file access and modification.

***

## **Key Timestamps in USB Forensics**

1. **First Connection Time**:
   * Indicates the initial connection of the USB device to the system.
2. **Last Connection Time**:
   * Tracks the most recent usage of the USB device.
3. **Disconnection Time**:
   * Marks when the device was last safely removed or ejected.

***

## **Common Scenarios in USB Forensics**

### **1. Data Theft**

* **Goal**: Investigate whether sensitive files were copied to or from a USB device.
* **Evidence**: Identify file paths, timestamps, and user accounts associated with the transfer.

### **2. Malware Propagation**

* **Goal**: Detect malware or **auto-run scripts** on the USB device.
* **Evidence**: Analyze USB content for **malicious payloads** or **executables**.

### **3. Insider Threat**

* **Goal**: Examine unauthorized activities involving USB devices.
* **Evidence**: Determine file access, transfers, or deletions by specific employees.

### **4. Policy Violations**

* **Goal**: Detect usage of unauthorized USB devices in restricted environments.
* **Evidence**: Correlate system policies with observed device connections.

***

## **Challenges in USB Forensics**

1. **Encryption**:
   * **Encrypted USB devices** may limit access to stored data without proper credentials.
2. **Deleted Artifacts**:
   * Attackers often delete files or logs to cover their tracks.
   * **Countermeasure**: Use **volume shadow copies** and **system logs** to recover data.
3. **Reformatted Devices**:
   * Formatting removes most user-accessible data, but traces may still exist in **shadow copies** or **event logs**.

***

USB forensics is a vital discipline in digital investigations, offering critical insights into **data movements** and **system interactions**. By leveraging forensic methods and tools to analyze USB activities, investigators can uncover unauthorized actions, mitigate breaches, and enforce security policies. Whether dealing with **data theft**, **malware propagation**, or **insider threats**, USB forensics provides the necessary evidence to build a comprehensive understanding of security incidents.
