HomeCalendarCertificationsColumnsFeaturesForumResourcesVitals
 
Image
 
Latest Additions
 
EH-Net Login
Welcome Guest.
Lost Password?
No account yet? Register
Who's Online
We have 20 guests online
EH-Net Donations

Enter Amount:
$
Google Ads
EH-Net News Feeds
Latest Additions
Book Recommendations



 
Advertisement

You are here: Home arrow Forum arrow Ethical Hacking Discussions and Related Certificationsarrow Forensicsarrow Forensic images of USB devices in Windows
Ethical Hacker Community Forums
November 22, 2008, 09:14:01 AM *
Welcome, Guest. Please login or register.
Did you miss your activation email?

Login with username, password and session length
News: ChicagoCon 2-Day Ethical Hacking Conference with MS Blue Hats Oct 31 - Nov 1. Tickets Only $100! www.chicagocon.com/content/view/103/51/
 
   Home   Help Calendar Login Register  
Pages: [1]   Go Down
« previous next »
  Print  
Author Topic: Forensic images of USB devices in Windows  (Read 2483 times)
0 Members and 1 Guest are viewing this topic.
jimbob
Sr. Member
****
Offline Offline

Posts: 307



View Profile WWW
« on: January 02, 2007, 03:43:04 AM »
Hi,
I'm sure I could find lots of examples on the web, but how is it best to make a forensic image of a USB device e.g. thumb drive on windows? I rely on Linux of some variety to make forensic duplications of such devices but is it easy/possible to do this on windows? I'm sure that FTK and EnCase support this but are there any free/OS tools that will do the job?

Jim
Logged
pcsneaker
Jr. Member
**
Offline Offline

Posts: 73


View Profile
« Reply #1 on: January 02, 2007, 05:35:42 AM »
No matter what tool you are using you need a hardware write blocker to be absolutely sure to get a forensically sound image when doing it in windows.

There is a registry key to prevent write access to USB devices but I would not rely on that...
Logged
MCSA:Security (W2k, W2k3)
MCSE:Security (W2k, W2k3)
CPTS, Network+
mn_kthompson
Jr. Member
**
Offline Offline

Posts: 58



View Profile WWW
« Reply #2 on: January 02, 2007, 08:40:19 AM »
You might want to glance over the instructions I posted in another thread about gathering a hard drive image.  If you use that technique you should be able to gather and mount an image from a USB drive.  The only difference will be the device file to use.
http://www.ethicalhacker.net/component/option,com_smf/Itemid,54/topic,937.msg2826/#msg2826
Logged
Pages: [1]   Go Up
  Print  
« previous next »
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.7 | SMF © 2006-2008, Simple Machines LLC
Joomla Bridge by JoomlaHacks.com 		Valid XHTML 1.0! Valid CSS!
Page created in 0.04 seconds with 22 queries.
 
Sponsors

cwnp_moto__120x90.gif

Polls
During the most recent election, I:
 
Support EH-Net

Support EH-Net by
Buying all of your
Amazon items using
the search bar above.
cbtnuggets_logo_125.jpg
Try CBT Nuggets Free!
Recent Forum Topics
Vote For EH-Net

progenic.com
Click here to Vote!

Sadikhov.com
Top IT Cert Sites

binarica.com
Binarica Logo

Add to Technorati Favorites
technorati fave

 
         
Advertisement

© 2008 The Ethical Hacker Network
Joomla! is Free Software released under the GNU/GPL License.