It may be a case, where you think a user may have copied data onto a drive in an unauthorized manner and you need to determine the time periods in which their personal drive was plugged into the system. It may be the case that you need to see enumerate all of the USB storage devices plugged into a potentially infected machine to see where the infection may have spread. The artifacts of a USB drives presence that are meaningful to you will depend mostly on the circumstances surrounding your investigation. The question then becomes, what artifacts are of importance to us, and where can we find them. Pretty much anything you do on a system leaves some form of artifact. When examining a system for details or regarding a system compromise or data exfiltration it's these artifacts that provide clues to help build a picture of what happened.

When you log into a system you leave an entry in the system security log another artifact.

When you browse to a website in Internet Explorer you leave in artifact in the browser history that you visited that site. When discussing a system in the context of forensic examination we refer to the items left behind by a particular activity as artifacts. It's for these reasons that forensic examination of systems with a focus on USB drive artifacts has become a hot topic over the past several years. In addition to being a very effective transmission media for self replicating malware, these devices can also be used to remove sensitive, proprietary, or classified information from a network without authorization. It was at this point people really began to consider the implications of allowing users to freely plug USB drives into protected networks. This was never more evident than in 2008 when the Conficker virus rapidly spread across the Internet infecting millions of home and business computers, even managing to make its way onto the US Department of Defense classified and unclassified networks. Although portable USB drives have become a permanent fixture in the everyday life of the typical user, these devices continue to challenge the security of our networks.

Ntuser dat windows 7