Pages

Saturday, August 18, 2012

Tracking USB First insertion in Event logs

The tracking of USB removable disks has been discussed and analyzed in detail with the usual methods of looking at the windows registry for plugged in devices (USBSTOR keys), registry shell bags, SetupApi logs, etc.

A while back researching something else I happened to hit upon an artifact not known for this purpose, the 'Windows Event Log'. The first time a USB device is inserted into your windows PC, it is logged in a little obscure log which is maintained for the 'ReadyBoost' functionality. This is only true for Windows Vista and above, as XP did not have ReadyBoost. For more information on ReadyBoost refer here

Whenever a new drive is connected to a windows system, windows will test that drive's read/write speed by creating a file on that drive and then deleting it. And this result is logged in the ReadyBoost log. From an investigator point to view, this does not give us too much information about the connected disk, but it does give some useful information, notably the name of the disk, sometimes the size (as shown in pic below) and the date/time when device was first connected to that system. This should correlate to the SetupApi log date/time. 

ReadyBoost Operational log under Windows Event Viewer

The messages are usually under EventID 1000-1023 with 1015 and 1016 being irrelevant (performance calculations for booting). It even logs the devices that are not disks such as 3G dongles and non-USB devices such as mounted VHD files with messages such as these:

This was for a partition on a mounted VHD file.
The date/time of log matches the date/time when partition was created.

When a new 3G dongle was plugged in..

When an IronKey was plugged in..

With this artifact, we have one more thing to confirm the date of first insertion of a device. This should be useful in cases where sometimes the registry keys make it difficult to confirm dates or device names/types.

The full path of this event log file on the system is
'C:\Windows\System32\winevt\Microsoft-Windows-ReadyBoost%4Operational.evtx'.

In the windows event viewer, you can view this log under
'Applications and service logs\Microsoft\Windows\ReadyBoost\Operational'. 

24 comments:

  1. Nice artifact, Yogesh. Given the lack of adoption of ReadyBoost by consumers, I'm guessing we won't see this one after Windows 7.

    This reminds me of one of my favorite Event Log artifacts for removable media: the "UserPnp" events now present in the Windows 7 System Log. Event ID 20001 provides information similar to the setupapi.dev.log, but formatted like the USBSTOR registry key.

    ReplyDelete
    Replies
    1. I'm happy to report that this Event Log is indeed present in the Windows 8 RTM.

      Delete
    2. I figured I would share this on here since Chad mentioned it.

      sourcetype=WinEventLog:System EventCode="20001" |dedup Message |rex field=Message "Driver Management concluded the process to install driver (?.*) for Device Instance ID (?.*) with the following status: (?0x0)" |search driver_name="*\disk.inf" NOT driver_name="*\flpydisk.inf" |table _time usb_info status

      Delete
  2. Thanks for sharing this information. I really like your blog post very much. You have really shared a informative and interesting blog post with people. bike

    ReplyDelete
  3. Acknowledges for paper such a beneficial composition, I stumbled beside your blog besides decipher a limited announce. I want your technique of inscription. free movie download

    ReplyDelete
  4. Extremely pleasant and fascinating post. I was searching for this sort of data and appreciated perusing this one. Continue posting. Much obliged for sharing.
    phone

    ReplyDelete
  5. Wonderful illustrated information. I thank you about that. No doubt it will be very useful for my future projects. Would like to see some other posts on the same subject hk financing

    ReplyDelete
  6. Thank you so much for share such a wonderful information and ideas. The author clearly describe all the parts of the article and we can easily understand each and every information. Quality articles is the vital to welcome the clients to pay visit the webpage, that’s what this site is giving. quick fund capital

    ReplyDelete
  7. That is really nice to hear. Thank you for the update and good luck fastcapitalhk.com

    ReplyDelete
  8. That’s great post!! I like your every post they always give me some new knowledge fastcapitalhk.com

    ReplyDelete
  9. Unicc is currently hosting their services via intcvv.cx and they are soon going to declare their new website. Happy to get back in business with them.

    ReplyDelete
  10. I was aware of this reality from his significant other, Laura, thus I purchased and introduced the mammoth novel to him. Laura took endless photos of the party with her advanced camera to deify the event. Deep Etiching Service

    ReplyDelete
  11. Extremely pleasant and fascinating post. I was searching for this sort of data and appreciated perusing this one. Continue posting. Much obliged for sharing. Ukraine

    ReplyDelete
  12. A smidgen of exploration can help you a great deal. Recall since jumpers cost pretty much than their rival, it means they are worse.Bounce house rentals
    All Fun Bouncing Inflatables

    ReplyDelete
  13. Best quality Mouse price in Bangladesh Discover a wide range of Mouse including RAZER, Apple, GAMDIAS Logitech mouses at best price in Bangladesh Shop online or visit your nearest Star Tech Shop. mause

    ReplyDelete
  14. I have bookmarked your blog, the articles are way better than other similar blogs.. thanks for a great blog!+B203:B223 congratulations to dad on his birthday

    ReplyDelete
  15. Awesome blog. I enjoyed reading your articles. This is truly a great read for me. I have bookmarked it and I am looking forward to reading new articles. Keep up the good work! congratulations on your birthday

    ReplyDelete
  16. Thanks for taking the time to discuss this, I feel strongly about it and love learning more on this topic. congratulations to mom on her birthday

    ReplyDelete
  17. This is such a great resource that you are providing and you give it away for free. I love seeing blog that understand the value. Im glad to have found this post as its such an interesting one! I am always on the lookout for quality posts and articles so i suppose im lucky to have found this! I hope you will be adding more in the future... poems to a loved one

    ReplyDelete
  18. I just found this blog and have high hopes for it to continue. Keep up the great work, its hard to find good ones. I have added to my favorites. Thank You. gps equipment tracking

    ReplyDelete
  19. I like the valuable info in your articles. I'll bookmark your blog and check again here regularly.
    I'll learn plenty of new stuff right here! Best of luck for the next! Regards.
    Moving to Idaho

    ReplyDelete
  20. Super site! I am Loving it!! Will return once more. I'm taking your sustenance in addition. Thanks
    Reverse Mortgage Age Requirement


    ReplyDelete
  21. Generally significant, it was viable with birthday man, Mike's scholarly twisted of brain and tastes. https://www.spotifyfame.com/

    ReplyDelete
  22. I have to look for goals with essential information on given point and offer them to instructor our inclination and the article. 의왕출장안마

    ReplyDelete