Exposing vital forensic artifacts of USB devices in the Windows 10 registry
Authors
Shaver, Jason S.
Subjects
Windows Registry
computer forensic
computer forensic
Advisors
Rowe, Neil
Date of Issue
2015-06
Date
Jun-15
Publisher
Monterey, California: Naval Postgraduate School
Language
Abstract
Digital media devices are regularly seized pursuant to criminal investigations and Microsoft Windows is the most commonly encountered platform on seized computers. Microsoft recently released a technical preview build of their Windows 10 operating system which can run on computers, smart phones, tablets, and embedded devices. This work investigated the forensically valuable areas of the Windows 10 registry. The focus was on the Windows Registry hives affected when USB storage devices are connected to a laptop configured with Windows 10. Paths were identified that indicate the date/time of last insertion and removal of a thumb drive. Live monitoring and post-mortem forensic methodologies were used to map Registry paths containing USB identifiers such as make/model information, serial numbers and GUIDs. These identifiers were located in multiple paths in the allocated and unallocated space of the Registries analyzed.
Type
Thesis
Description
Series/Report No
Department
Cyber Academic Group
Cyber Academic Group
Organization
Identifiers
NPS Report Number
Sponsors
Funder
Format
Citation
Distribution Statement
Approved for public release; distribution is unlimited.
Rights
This publication is a work of the U.S. Government as defined in Title 17, United States Code, Section 101. Copyright protection is not available for this work in the United States.