USB device forensics can be difficult. It is fraught with a number of caveats. The data points that can be relied upon vary based on the specific version of Windows, the type of USB device, the type of drive on which the operating system is installed, and more. Compounding these, Windows 10 further complicated things with the device cleanup process, which removes USB device-related records from locations that have long been relied upon by tools and examiners. To help combat these issues and more, I developed USB Detective.
For those that want to skip the details below, USB Detective can be downloaded from usbdetective.com. There are two versions of USB Detective: community and professional. The community version can be freely downloaded and the professional version can be purchased from the site. Note that you must have .NET version 4.6 or higher installed to run USB Detective!
USB Detective aims to ease the burden on the examiner by visually distinguishing attributes with inconsistent timestamps from those with multiple corroborating sources. This is accomplished by leveraging numerous data points for the identification of USB device attributes such as the first connected and last connected time. USB Detective organizes its findings in a way that allows for easy reporting to non-technical individuals or in-depth analysis and reporting for examiners. The source of every value reported by USB Detective is also maintained to allow the examiner to verify and document the results.
Associating a single data point with a specific event, such as a device connection or disconnection, can be problematic if the examiner ignores the context of the data point. For example, the Enum\USB subkey hierarchy in the SYSTEM hive is a well-known location for, in some cases, identifying the last time a USB device was connected to a system. However, this subkey hierarchy can be updated through events that result in the Last Write time of all subkeys in the hierarchy being updated to the same date and time. This is a well-known behavior, but one that an examiner must be cognizant of during analysis. In many cases, there are other data points available that accurately reflect the targeted event.
Investigating multiple data points known to be tied to the target event allows the examiner to identify corroborating timestamps and determine the overall consistency across the data points. For example, an examiner taking this approach may determine that four out of five of the data points (subkeys, values, log entries, etc.) known to be associated with the target event are the same or within a couple of seconds of one another. This would likely increase the examiner’s confidence in his or her findings and help to identify unreliable data points on the system under investigation.
USB Detective takes into account multiple data points that are available for some of the key USB device attributes such as first connected, last connected, volume name, and more. After compiling all queried timestamps associated with a specific event, the gathered timestamps are compared and the consistency of the reported timestamp is displayed to the user via USB Detective’s consistency level color-coding. This allows the examiner to quickly identify the specific attributes that have inconsistent timestamps and those that have multiple sources of corroborating data.
|USB Detective Results Grid|
Windows 10 Woes
Windows 10 (and some earlier versions) removes some of the most well-known USB device artifacts through its “device cleanup” procedure for devices that have not been recently used by the system. David Cowen reported this in April last year and described a scheduled task that will remove many common USB device registry subkeys during the process, including those in USBSTOR, USB, WPDBUSENUM, and STORAGE. In other words, USB device entries in these locations are removed during the device cleanup procedure. I have observed that a similar action occurs during Windows upgrades, such as upgrading to the Fall Creator’s edition of Windows. During the upgrade, USB storage device-related entries will be removed from many of the well-known locations, including the four subkeys mentioned earlier. This is obviously problematic when it comes to USB device analysis. If a tool or examiner is relying only on the common USB device locations, information about many devices could be missed.
|Before Windows Upgrade||After Windows Upgrade|
In addition to the common areas such as USBSTOR, USB Detective probes many other locations – including some that are not currently covered by the device cleanup procedure performed by Windows. In many cases, the last disconnect time of devices that have been cleared by the device cleanup procedure will still be available (in addition to device serial, description, volume name, and more). The date/time that a device was removed via the device cleanup procedure is also identified and reported by USB Detective. Knowing when a device was removed by the device cleanup procedure can help to provide clarity to the examiner with regard to why certain information about some devices is unavailable. If multiple versions of the registry hives (including amcache hives) are available from volume shadow copies or other means, they can all be fed into USB Detective in order to build a more complete picture of USB device activity on a system.
USB Detective aims to simplify the USB device analysis process by identifying USB device data from dozens of locations, reporting key USB device attributes, and highlighting conflicting and corroborating data points. There are many additional features not mentioned here that are currently available in USB Detective as well as many others on the road map for later release. To learn more about USB Detective or to try it out, visit usbdetective.com.