Windows操作系统环境下调查USB设备使用痕迹方法研究.docx

刑事技术2015 年 第40 卷 第2 期DOI:10.16467/j.1008-3650.2015.02.013·论著·Windows操作系统环境下调查USB设备使用痕迹方法研究段严兵，罗文华（中国刑事警察学院网络犯罪侦查系，沈阳110854）USB Device Usage Traces in WindowsEnvironmentDUANYan-bing,LUOWen-hua(DepartmentofNetworkCriminalInvestigation,NationalPoliceUniversityofChina,Shenyang110854,China)ABSTRACT:Inthepracticeofdigitalforensics,thekeyevidencetoprovethecriminalfactsmostlyexistsinthemountedUSBdevices.ToobtaintheusagetracesofinspectingUSBdeviceseverbeingmountedisatypicalidentificationrequirementof digitalforensics.Therearesomeexistingforensictoolsthatsupporttheanalysisofsuchinformation.However,extractingtracesinactualworkisnotaccurate(especiallyUSBdeviceserialnumber)andnotcomplete(suchaslackingtheinformationofUSBdriveletter).Itisdifficulttomeettheneedofforensicpractice.Inordertomakeupfordeficiencies,thispaperinvestigatesUSBdevicesusagetracesfromtwoaspectsbasedontheperspectiveoftheelectronicdataforensics.OneisusingtheregistrytoinspectUSB devices usage traces. The registry is the main and important source of USB devices usage traces. This paper describestheforensicsofUSBkeyandUSBSTORkeyindetail,andgivestheextractingmethodoftemporalinformationandcorrelationmethodwithMountedDeviceskey.ItalsoprovidestheanalysisofUMBkeythatisthenewincreaseofWindows7system. UMBkeycoverstheimportantinformationforUSBkeyandUSBSTORkey,whichindicatestheinformationofUSBdriveletterandmakesupforthedefectofMountedDeviceskey.TheotheraspectisusingthesystemfilestoinspectUSBdevicesusagetraces. This also has direct significance for meeting forensic requirements. Setupapi.dev.log file in Windows 7 systempartitioncontainsthedataabouttheequipmentreplacement,thedriverchangeandtheimportantsystemmodification.Theinvestigationand analysis of Setupapi.dev.log file usually obtains the same effect as that of registry. The system log in Windows 7 eventlogincreasestheaudittoUSBdevices.ItrecordstheunloadinginformationofUSBdevices.TheshortcutfilesinRecentfoldercontain the target file attributes and users’ operation inform