Notifications
Clear all

SD card forensics

3 Posts
3 Users
0 Likes
2,029 Views
(@ross-thomas1)
Posts: 1
New Member
Topic starter
 

I'm currently looking to establish a connection between a laptop and a series of Micro SD cards.

The laptop in question has a standard SD card slot, which I think was used to connect the Micro SD cards using an SD card to Micro SD card adaptor.

Am I likely to get to get anything in the registry indicating that Micro SD card has been inserted into the device?

I have a .LNK file on the laptop which circumstantially matches a file found on the Micro SD card but I want to concrete each Micro SD card as being inserted to the laptop.

Ross

 
Posted : 30/09/2019 8:12 am
Bunnysniper
(@bunnysniper)
Posts: 257
Reputable Member
 

Am I likely to get to get anything in the registry indicating that Micro SD card has been inserted into the device?

Try Regripper. And SD cards and USB drives are very often managed by the same controller. So you can use a lot of USB forensic tools which give you the serial number of the device as well. The registry is FULL with evidence of connected devices and mounted network drives.

regards, Robin

 
Posted : 30/09/2019 9:21 am
(@deefir)
Posts: 49
Eminent Member
 

USBStor, amcache, setupAPIlog, etc.

USB Detective has a free/community version. As suggested, reg ripper is also good.

Some other threads which may help you;

https://www.forensicfocus.com/Forums/viewtopic/t=9403/
https://df-stream.com/2017/10/amcache-and-usb-device-tracking/

 
Posted : 01/10/2019 1:42 am
Share: