Microsoft Windows 10 USB Forensic Artefacts
As the capacity of USB storage devices continues to increase and the price decreases, USB forensics will often play an important part in many forensic investigations. Add to the mix a range of mobile devices such as smart phones, tablets, digital cameras and the ease of connectivity means that there are a lot of USB artifacts to be found if we know where to look. For example in Windows 7, the Microsoft-Windows-DriverFrameworks-UserMode%4Operational.evtx log file contains useful information such as time stamps for the connection and disconnection of USB removable drives.
Read More