Tracking USB storage: Analysis of windows artifacts generated by USB storage devices [An article from: Digital Investigation]

This digital document is a journal article from Digital Investigation, published by Elsevier in 2005. The article is delivered in HTML format and is available in your Amazon.com Media Library immediately after purchase. You can view it with any web browser.

Description:
When a USB storage device, such as a thumb drive, is connected to a Windows system, several identifiers are created on the system. These identifiers, or artifacts, persist even after the system has been shut down. In many cases, these artifacts may be used for forensics purposes to identify specific devices that have been connected to the Windows system(s) in question.