Fiddling with Flash Drive Forensics

No ratings

Presented at BSidesSatX 2018 by

"It always makes me nervous when you ask questions in class, Alex... Your brain is more evil than mine." -Dr. Beebe, Digital Forensics ProfessorOne day in class, we were discussing the list of USB drives plugged into a Windows machine showing in the registry and it was said they can be used as evidence a drive has been inserted into this machine, but the lack of a key isn't evidence of it NOT having been plugged in (You can always delete the key). I asked ""can I export a key from one computer pertaining to a drive and just plant it by importing it?"" and this presentation was born.