How to Approach USB Key Forensics on VISTA 2. Write Down Devices\Devices Perform search for SYSTEM\MountedDevices Perform Search for CurrentVersion\Explorer\MountPoints2 00a0c91efb8b} Perform search for S/N C:\Windows\inf\setupapi.dev.log Perform search for http://forensics.sans.org http://twitter.com/sansforensics 1
Profile VISTA/Win7 USB Devices USBDEVICE 1 2. Write Down s for
USBDEVICE 2 2. Write Down s for
USBDEVICE 3 2. Write Down s for
USBDEVICE 4 2. Write Down s for