USB Forensics - Reconstructing Digital Data from a USB Drive

[DronVR]

USB Forensics - Reconstructing Digital Data from a USB Drive

USB forensic digital analysis includes preservation, collection, verification, identification, analysis, interpretation, documentation and presentation digital data (evidence) obtained from digital sources, in order to facilitate or further restore events that have been criminalized.

Disk Image Processing - USB Forensics:

• A disk image is defined as a computer file, where there is content and structure of the data storage device, it can be hard drive, CD-drive, phone, tablet, RAM or USB stick .
• A disk image consists of actual content data storage devices , as well as the information needed to replicate the structure and layout of device content.
• However, a wide range of well-known tools is used in court for analysis.
• Standard tools allowed exclusively in accordance with the law . Forensic experts do not allow image processing using unknown tools, or new tools.
• Standard tools : Encase Forensic Imager and its extension (Imagename.E01) Forensic Instruments and Analysis:
• Because Encase forensic software costs about $ 2,995.00 - $ 3,594.00 , then in this article, data processing and analysis will be carried out using forensic analysis software FTK (FTK Forensic software), created Accessdata .

FTK Includes a standalone drive, simple but clear tool.

FTK imaging unit

The image above is a panel Access data FTK Imager .

Evidence tree

• Click on the green button in the upper left corner to add data to the panel and select the type of data source.
• Data source - logical drive ( USB )

Logical drive

• Check the drop-down menu to select HP USB for analysis

Data tree data

• Expansion USB device data tree will represent a general view of data deleted in the past.
• Scroll again to check and explore type of deleted data.

Warning: it is recommended not to work with the original data during the investigation, because accidentally copying new data to USB will be superimposed on past deleted files on the USB drive. Data integrity does not work, so always work with a forensic copy of the image.
USB image creation:

Choose and create disk image from the file menu.

Disk image format

Click the Add button and select appropriate type format image E01.

The figure above illustrates that the selected image type - E01 .

Data Information

Should necessarily Add additional information about USB type, size, color and more data identification information.

Destination Address

Choose the destination path of the USB file C: \ Users \ Balaganesh \ Desktop \ New folder and the image file name is HP Thumb Drive.

Image Capture - USB Forensics

• This image shows that the image is a USB format .E01 is in the process of processing.
• Creating a file image can take anywhere from a few minutes to several hours.

Forensic image:

Unplug the USB drive and keep the original data safe and always work with an image specially made for forensic analysis.

This image shows that a forensic copy or image should be selected. In this case, the image for forensic analysis is HP.E01

Digital Data Analysis:

The image illustrates some dubious activity on a USB drive that can be detected.

Deleted antivirus, illegal materials and other folders.

Recovery of deleted files and folders:

Here we found out that USB contains some suspicious file names in pdf format.

Data Extraction:

Finally, we restored the Tor malicious links in .onion in pdf format as evidence. Happy investigation !!!

Note: In some cases, the extracted file may be empty; it indicates that new files have been recorded. In this case, the file attributes will be evidence.

Source