EnCase missed some usb activities in the evidence files
Posted Pieces0310
tags:
篇首语:本文由小常识网(cha138.com)小编为大家整理,主要介绍了EnCase missed some usb activities in the evidence files相关的知识,希望对你有一定的参考价值。
My friend is a developer and her colleague May was suspected of stealing the source code of an important project "X". The Police searched her apartment and seized her brand new laptop which OS is Win10 Pro. Forensic guy Terry used EnCase to do evidence processing . To his surprise, only one usb thumb drive "SanDisk" found in "USB Records".
Terry checked LNK files artifacts and found a very interesting thing. According to the volume serial number, we could distinguish which volume belongs to local drive. Local drive only has one volume and its drive letter is "C". Terry found two volume serial number "d63e3c12" and "beebc8cb" related to external drive as below.
Fortunately LNK file artifacts gave Terry very important clue. Terry believed that more than one usb thumb drive\'s been plugged into May\'s laptop. Why EnCase missed some usb activities in the evidence files?
We can not be too careful to analyze the evidence when something strange occurs.Let\'s use another forensic tool to examine usb artifacts again. Besides sandisk another usb thumb drive found and its name is "Seagate ". The same name found in LNK files artifacts.
According to the volume serial number and usb deive serial number as above, the Police found those two usb storage devices in May\'s company. Finally May admited that she copied the source code of project "X" into a SanDisk usb thumb drive and a 2.5" Seagate Backup Plus usb drive. And she brought those two usb device home. She\'d like to sell those stuff to earn more money.
Guidance should take a look at its "USB Records" to see what\'s wrong with incomplete usb activities after evidence processing.
以上是关于EnCase missed some usb activities in the evidence files的主要内容,如果未能解决你的问题,请参考以下文章
求知的木头 Cannot load browser "PhantomJS": it is not registered! Perhaps you are missing some
Unable to fetch some archives ,maybe run apt-get update or try with --fix-missing?