← back to portfolio
Digital Forensics
USB Data Exfiltration Investigation
Executive Summary
A removable USB device was connected to the host and used to access a folder containing sensitive
employee data. Registry, shellbag, and jump list artifacts were correlated to identify the device,
its assigned drive letter, the folder accessed, and the specific file containing PII that was opened —
establishing a full timeline of device connection through data access.
Scenario
Investigate USB device activity and determine whether data was accessed from a removable device.
Evidence Collected
| Artifact | Source | Why It Mattered |
|---|
| USBSTOR | SYSTEM hive (ControlSet001) | Provided device information and serial number |
| Properties\0064 | USBSTOR Properties key | Provided first connection timestamp |
| Event ID 142 | NTFS Operational Log | Revealed assigned drive letter |
| Shellbags | UsrClass.dat | Revealed folder access activity |
| Jump Lists | JumpList Explorer | Revealed application used to open files |
Timeline
| Time (UTC) | Event | Source |
|---|
| 2024-07-15 03:36:22 | USB device first connected | USBSTOR Properties\0064 |
| 2024-07-15 03:37:28 | Folder NewProject_Hires_Data browsed | Shellbags |
| 2024-07-15 03:38:07 | Employee_PII.csv opened | Jump Lists |
Key Findings
- The USB device was first connected on 2024-07-15 at 03:36:22 UTC.
- The device serial number was 5639311262174133917.
- The device was assigned drive letter E:\.
- The folder containing the accessed data was named NewProject_Hires_Data.
- The file Employee_PII.csv was opened using 64-bit Notepad.
Attack Chain
Device Connection
USB removable device connected to the host.
Drive Assignment
Device assigned drive letter E:\.
Folder Access
Folder NewProject_Hires_Data browsed on the device.
File Access
Employee_PII.csv accessed and opened using Notepad 64-bit.
Analyst Notes
Started with the SYSTEM hive using Registry Explorer and loaded the associated LOG files.
Investigated ControlSet001\USBSTOR to identify device information and serial number.
Used the Properties\0064 key to determine the first connection timestamp.
Pivoted to Event ID 142 in the NTFS Operational log to identify the assigned drive letter.
Used Shellbags from UsrClass.dat to identify the folder accessed on the USB device.
Used Jump Lists to determine the application used to open the files.
Lessons Learned
- USBSTOR contains device information and serial number data.
- Event ID 142 can be used to identify assigned USB drive letters.
- Shellbags provide evidence of folder browsing activity.
- Jump Lists provide evidence of recently opened files and associated applications.