Searching for USB Devices

Daniel Eckart

One of the key aspects of searching for digital media is being able to identify and locate removable storage. USB storage can come in all shapes and sizes and can be extremely small and easy to conceal.

When it comes to Windows computers, every time you insert a USB device it makes a record in the registry. This is stored on the computer’s hard drive and therefore can be discovered and evidenced during a standard forensic examination.

The problem is that a standard forensic investigation will usually take place days, weeks or months after a search has taken place and discovering the existence of a USB device that you should have searched for it like seeing what you could have won.

One answer is to use a piece of free software developed by Sir Sofer and available on his site at https://www.nirsoft.net.

In this video I will demonstrate how to download the application and run it from your own USB stick on the subject computer.