• EnCase missed some usb activities in the evidence files


    My friend is a developer and her colleague May was suspected of stealing the source code of an important project "X". The Police searched her apartment and seized her brand new laptop which OS is Win10 Pro.  Forensic guy Terry used EnCase to do evidence processing . To his surprise, only one usb thumb drive "SanDisk" found in "USB Records".

    Terry checked LNK files artifacts and found a very interesting thing. According to the volume serial number, we could distinguish which volume belongs to local drive. Local drive only has one volume and its drive letter is "C". Terry found two volume serial number "d63e3c12" and "beebc8cb" related to external drive as below.

    Fortunately LNK file artifacts gave Terry very important clue. Terry believed that more than one usb thumb drive's been plugged into May's laptop. Why EnCase missed some usb activities in the evidence files?

    We can not be too careful to analyze the evidence when something strange occurs.Let's use another forensic tool to examine usb artifacts again. Besides sandisk another usb thumb drive found and its name is "Seagate ". The same name found in LNK files artifacts.

    According to the volume serial number and usb deive serial number as above, the Police found those two usb storage devices in May's company. Finally  May admited that she copied the source code of project "X" into a SanDisk usb thumb drive and a 2.5" Seagate Backup Plus usb drive. And she brought those two usb device home.  She'd like to sell those stuff to earn more money.

    Guidance should take a look at its "USB Records" to see what's wrong with incomplete usb activities after evidence processing.

  • 相关阅读:
    Salesforce: 测试代码写在非测试类中
    Salesforce: 使用代码编辑日期时间
    测试用例练习
    DFA算法实现敏感词过滤
    基于redis实现分布式锁
    Python检查字符串之间的相似度
    二维码生成器
    MySQL 备份/恢复
    实现阿里云短信验证
    SnowFlake 生成唯一订单id
  • 原文地址:https://www.cnblogs.com/pieces0310/p/7631696.html
Copyright © 2020-2023  润新知