How to Approach USB Key Forensics on XP 2. Write Down Serial Number 3. Determine SYSTEM\MountedDevices Perform search for SYSTEM\MountedDevices Perform Search for CurrentVersion\Explorer\MountPoints2 00a0c91efb8b} Perform search for S/N C:\Windows\setupapi.log Perform search http://forensics.sans.org http://twitter.com/sansforensics 1
Profile XP USB Devices USBDEVICE 1 3. Determine
USB DEVICE 2 3. Determine
USB DEVICE 3 3. Determine
USBDEVICE 4 3. Determine