Windows操作系统环境下调查USB设备使用痕迹方法研究

获取送检介质曾经挂载的USB设备使用痕迹,是电子数据取证实践中典型鉴定需求之一。虽然现有取证工具有的声称支持此类信息的分析,但实际工作中发现其提取到的痕迹(特别是USB设备序列号)并不准确,同时也不够全面(如缺少USB设备被分配的盘符信息),难于满足取证实践的需要。传统的此类痕迹调查完全依靠注册表中的USBSTOR表键,为弥补其不足,本文基于电子数据取证视角,在详细说明USBSTOR表键取证关键的基础上,增加了USB和UMB表键的分析;并阐述了在相关注册表键被清除的情况下,如何依靠系统文件补充调查USB设备使用过程中可能留有的痕迹。实践证明,所述方法准确高效。

In the practice of digital forensics, the key evidence to prove the criminal facts mostly exists in the mounted USB devices. To obtain the usage traces of inspecting USB devices ever being mounted is a typical identification requirement of digital forensics. There are some existing forensic tools that support the analysis of such information. However, extracting traces in actual work is not accurate (especially USB device serial number) and not complete (such as lacking the information of USB drive letter). It is difficult to meet the need of forensic practice. In order to make up for deficiencies, this paper investigates USB devices usage traces from two aspects based on the perspective of the electronic data forensics. One is using the registry to inspect USB devices usage traces. The registry is the main and important source of USB devices usage traces. This paper describes the forensics of USB key and USBSTOR key in detail, and gives the extracting method of temporal information and correlation method with MountedDevices key. It also provides the analysis of UMB key that is the new increase of Windows 7 system. UMB key covers the important information for USB key and USBSTOR key, which indicates the information of USB drive letter and makes up for the defect of MountedDevices key. The other aspect is using the system files to inspect USB devices usage traces. This also has direct significance for meeting forensic requirements. Setupapi.dev.log file in Windows 7 system partition contains the data about the equipment replacement, the driver change and the important system modification. The investigation and analysis of Setupapi.dev.log file usually obtains the same effect as that of registry. The system log in Windows 7 event log increases the audit to USB devices. It records the unloading information of USB devices. The shortcut files in Recent folder contain the target file attributes and users’ operation information, which can change with user behaviors. Using WFA tool and Windows 7 files with extension automaticDestinations-ms can resolve the target file information of the shortcut files in the Recent folder. IconCache.db is the icon cache file for windows system. Users’ behaviors using Windows system can gradually add to the IconCache.db file, including the information of file icon, storage path and so on. Using IconCache.db file also can analyze the usage traces of USB devices. When users connect USB storage devices to computer system, the information will be added to the IconCache.db database if the root directory contains executable program. In addition, this paper expounds how to rely on the system files to make a supplementary investigation of USB usage traces in the case of the relevant registry keys being cleared. Proved by practice, the method is accurate and efficient.