1. 4.6 Attached device analysis
함다니 꾸스나디
-사이버경찰 학과-

2. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Print\Printers
a. Printers There are a number of keys within the Registry that hold information about printer drivers that exist in the system. One of these keys is the following: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Print\Printers This key lists printer drivers that exist in the system. The investigator can get more information about each printer driver if he accesses the PrinterDriverData sub key. For example, installed date and model name as shown in Figure 17.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Print\Printers

3. Journal of Digital Forensics, Security and Law, Vol
Journal of Digital Forensics, Security and Law, Vol. 5(4) 20 Figure 17: Valuable forensics elements of printer drive within Windows Registry b. USB Devices Any time a new USB Device is connected to the system, it will leave information about this USB device within the Registry. This information can uniquely identify each USB device connected to the system. The Windows Operating system stores vendor ID, product ID, Revision and Serial No. for each connected USB device. This information can be found in the following Registry key (Carvey & Kleiman, 2007): HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\USBSTOR Figure 18 shows how information about USB devices stored in the previous key. Figure 18: USB device information within Windows Registry.

4. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\USBSTOR

5. 4 Key Artifacts That Need to be Found When Investigating USB Device History
The USBSTOR located in the SYSTEM hive (SYSTEM/CurrentControlSet/Enum/USBSTOR) USBSTOR contains details on the vendor and brand of USB device connected, along with the serial number of the device that can be used to match the mounted drive letter, user, and the first and last connected times of the device.
The MountedDevices key (SYSTEM/MountedDevices)  Allows investigators to match the serial number to a given drive letter or volume that was mounted when the USB device was inserted. It’s possible that the investigator won’t be able to identify the drive letter if several USB devices have been added, since the mapped drive letter only shows the serial number for the most recently mounted device for each letter assigned.
The MountPoints2 key found in a user’s NTUSER.dat hive (NTUSER.datSoftwareMicrosoftWindowsCurrentVersionExplorerMountPoints2) This information will reveal which user was logged in and active when the USB device was connected. MountPoints2 lists all of the device GUIDs that a particular user connected, so you might need to search through each NTUSER.dat hive on the system to identify which user connected a particular device.
The USB key in the SYSTEM hive (SYSTEM/CurrentControlSet/Enum/USB)  This key provides investigators with vendor and product ID for a given device, but also provides the last time the USB device was connected to the system. Using the last write time for the key of the device serial number, investigators can identify the last time it was connected.