Next Article in Journal
SDR Based Indoor Beacon Localization Using 3D Probabilistic Multipath Exploitation and Deep Learning
Previous Article in Journal
Magnetic Loss Analysis in Coaxial Magnetic Gears
Open AccessFeature PaperArticle

USB Artifact Analysis Using Windows Event Viewer, Registry and File System Logs

by Ashar Neyaz †,‡ and Narasimha Shashidhar *,‡
Department of Computer Science, Sam Houston State University, Huntsville, TX 77341, USA
*
Author to whom correspondence should be addressed.
Current address: 1900 Avenue I, Suite 214, Academic Bldg One, Huntsville, TX 77341, USA
These authors contributed equally to this work.
Electronics 2019, 8(11), 1322; https://doi.org/10.3390/electronics8111322
Received: 30 September 2019 / Revised: 30 October 2019 / Accepted: 7 November 2019 / Published: 9 November 2019
(This article belongs to the Section Computer Science & Engineering)
A USB mass storage device yields a lot of artifacts when connected to a system. These artifacts are persistent in nature and are retained even after the system has been shut down and the information they contain may assist in carrying out forensic analysis on a suspect system. In this paper, we demonstrate how Windows Event Viewer can be used to find forensic artifacts in a suspect system for investigative purposes. We also discuss the potential that Windows registry holds to identify USB devices’ information that have been connected to the system, to corroborate our findings from Windows Event Viewer. Finally, we use the Windows 10 file system to extract log details that contain the setup information of a USB device that was connected to the system the very first time, and obtain the necessary identifiers and time stamp details.
Keywords: USB storage; Windows Event Viewer; registry; operating system logs; digital evidence; forensic artifacts USB storage; Windows Event Viewer; registry; operating system logs; digital evidence; forensic artifacts
MDPI and ACS Style

Neyaz, A.; Shashidhar, N. USB Artifact Analysis Using Windows Event Viewer, Registry and File System Logs. Electronics 2019, 8, 1322.

Show more citation formats Show less citations formats
Note that from the first issue of 2016, MDPI journals use article numbers instead of page numbers. See further details here.

Article Access Map by Country/Region

1
Back to TopTop