An Investigation into the Development of an Anti-forensic Tool to Obscure USB Flash Drive Device Information on a Windows XP Platform

Author

Thomas, Paula ; Morris, Alun

Author_Institution

Fac. of Adv. Technol., Univ. of Glamorgan, Pontypridd

fYear

2008

fDate

9-9 Oct. 2008

Firstpage

60

Lastpage

66

Abstract

When a USB flash drive is plugged into a Windows XP computer, a number of registry settings and log files are automatically updated that reflect the use of the USB flash drive. This information is often important in criminal proceedings where the use of a USB flash drive can be shown to have copied data to and from the computer. The aim of this work was to evaluate the information that can identify USB flash drive usage on a Windows XP computer and to understand how that information could be used by a computer forensics investigator. A tool was produced to perform a function that allowed the amendment of the information concerned with USB flash device usage. This amendment of data will be intentional and deliberate and can therefore be defined as being an anti forensics tool.

Keywords

computer crime; device drivers; system buses; USB flash drive device information; Windows XP computer; antiforensic tool; criminal proceeding; log files; registry setting; Computer architecture; Computer crime; Data security; Digital forensics; Drives; Information analysis; Information security; Multimedia systems; Operating systems; Universal Serial Bus; Anti-forensic; USB Device;

fLanguage

English

Publisher

ieee

Conference_Titel

Digital Forensics and Incident Analysis, 2008. WDFIA '08. Third International Annual Workshop on

Conference_Location

Malaga

Print_ISBN

978-0-7695-3362-9

Type

conf

DOI

10.1109/WDFIA.2008.13

Filename

4651709