Title :
An Investigation into the Development of an Anti-forensic Tool to Obscure USB Flash Drive Device Information on a Windows XP Platform
Author :
Thomas, Paula ; Morris, Alun
Author_Institution :
Fac. of Adv. Technol., Univ. of Glamorgan, Pontypridd
Abstract :
When a USB flash drive is plugged into a Windows XP computer, a number of registry settings and log files are automatically updated that reflect the use of the USB flash drive. This information is often important in criminal proceedings where the use of a USB flash drive can be shown to have copied data to and from the computer. The aim of this work was to evaluate the information that can identify USB flash drive usage on a Windows XP computer and to understand how that information could be used by a computer forensics investigator. A tool was produced to perform a function that allowed the amendment of the information concerned with USB flash device usage. This amendment of data will be intentional and deliberate and can therefore be defined as being an anti forensics tool.
Keywords :
computer crime; device drivers; system buses; USB flash drive device information; Windows XP computer; antiforensic tool; criminal proceeding; log files; registry setting; Computer architecture; Computer crime; Data security; Digital forensics; Drives; Information analysis; Information security; Multimedia systems; Operating systems; Universal Serial Bus; Anti-forensic; USB Device;
Conference_Titel :
Digital Forensics and Incident Analysis, 2008. WDFIA '08. Third International Annual Workshop on
Conference_Location :
Malaga
Print_ISBN :
978-0-7695-3362-9
DOI :
10.1109/WDFIA.2008.13
