Comments on: USB Forensics http://niiconsulting.com/checkmate/2008/01/01/usb-forensics/ An Information Security Blog by NII Consulting Tue, 07 Feb 2012 12:10:45 +0000 hourly 1 http://wordpress.org/?v=3.3.1 By: Alok http://niiconsulting.com/checkmate/2008/01/01/usb-forensics/comment-page-1/#comment-129 Alok Mon, 12 May 2008 16:36:36 +0000 http://www.niiconsulting.com/checkmate/2008/01/usb-forensics/#comment-129 Nice article but i found "HKLM/System/CurrentControlSet/enum/USBSTOR" data different in vista OS. Nice article but i found “HKLM/System/CurrentControlSet/enum/USBSTOR” data different in vista OS.

]]> By: Victor Alba http://niiconsulting.com/checkmate/2008/01/01/usb-forensics/comment-page-1/#comment-128 Victor Alba Fri, 25 Apr 2008 20:57:46 +0000 http://www.niiconsulting.com/checkmate/2008/01/usb-forensics/#comment-128 On old w2k systems there was a couple of very helpful events 134 and 135 on system event log which can let us know whenever a USB removable device was plugged/unplugged (date & time). Is there something similar on XP and Vista. On old w2k systems there was a couple of very helpful events 134 and 135 on system event log which can let us know whenever a USB removable device was plugged/unplugged (date & time). Is there something similar on XP and Vista.

]]> By: Nels http://niiconsulting.com/checkmate/2008/01/01/usb-forensics/comment-page-1/#comment-127 Nels Wed, 02 Jan 2008 16:45:15 +0000 http://www.niiconsulting.com/checkmate/2008/01/usb-forensics/#comment-127 I appears the USBDeview link is missing. The URL for those interested is: http://www.nirsoft.net/utils/usb_devices_view.html I appears the USBDeview link is missing. The URL for those interested is:
http://www.nirsoft.net/utils/usb_devices_view.html

]]> By: Stefan http://niiconsulting.com/checkmate/2008/01/01/usb-forensics/comment-page-1/#comment-126 Stefan Wed, 02 Jan 2008 14:14:34 +0000 http://www.niiconsulting.com/checkmate/2008/01/usb-forensics/#comment-126 Hi Niiconsulting, Nice Artikel but unfortunately Figure 4 and Figure 5 are not acessible. BG Stefan Hi Niiconsulting,

Nice Artikel but unfortunately Figure 4 and Figure 5 are not acessible.

BG
Stefan

]]>