Hello and welcome back to windows registry forensics course five.
The software file section 3 USB connected devices.
We're going to take a look at some sub keys in the software file that I'm
going to give us some information about USB devices that were connected to
the system.
We're looking at the software registry file and
we're talking about USB devices that were connected to the system.
And we're going to look at two sub keys.
The two sub keys we're going to look at is we're going to look at the devices
sub keys.
And the path to that is going to be Microsoft Windows
portable devices and devices.
And the second key we're going to look at is called EMD management sub key.
And that's located in the software file
Microsoft Windows NT current version EMD management.
The device is sub key tracks windows portable devices.
So it's going to track USB devices.
The EMD management sub key is a little bit different.
It was put there as an extension of memory.
It actually stands for EMD stands for external memory device management.
And you'll often hear this referred to as ready boost.
And what ready boost does is it tests the USB device to see
if it can be used as external memory to extend your device memory.
If it passes the test, you'll see it too in the devices status value.
And this indicates that the device passed the test and can be used as cache memory.
Any other value in that devices, status column indicates that
the device did not pass and it cannot be used to extend the cache memory.
But we're not really concerned about whether or
not the device can extend the cache memory.
This two things we can see in the EMD
management sub key that are very important to us.
And that is the volume name and the volume serial number.
Now, this sub key might not have any information under it.
It doesn't always have anything and
it doesn't always have both the volume name and the volume serial number.
But if you are lucky enough to get that,
it is like the holy grail when you're going to investigate a system.
Because those two values are going to allow you to track things
back to link files within the system very easily.
So I'm always happy when I see values there.
The items were going to need for
this section is we're going to need registry explorer and
we're going to need Ivan software file, that windows 10, the MDK file.
So let's go ahead and if you haven't already done, so we're going to
launch registry explorer and the first thing we want to do is go to file.
If you haven't done it load hive, pick the software file and
go ahead and click open and the file will load.
I've already done that.
So we're not going to redo it.
Here we see the software file the devices sub key and again we talked
about the devices sub key and where we would find that in the file path.
And that would be Microsoft, Windows portable devices,
devices, when those portable devices, devices.
And we can see we have two sub folders here.
And that's representing two different USB devices that were attached to the system.
Now what we have here in this top value, this first folder.
This number here that starts to the 1, it ends with 6.
This the serial number not the volume serial number, but
the actual serial number of the device.
And that's a very important piece of information we want to have.
That next number next to it in brackets its looks
similar to a quid type structure is actually the disk ID.
And that is also very important because this value will allow us to
track the USB device throughout the registry.
If we look down at our next entry, we do have a disc ID but
we really don't have a serial number.
Not every USB device or it could be a pocket drive.
An external hard drive that you attach through USB
interface is may or may not have a serial number.
And even just the USB device itself may or may not have a serial number.
The system will assign them a number but
that number is only going to be relevant to that particular system.
It's not the serial number of the device.
So you want to be aware of that.
The sub key also has dates and times dates and times.
You want to make note of the dates and times that you have here.
Generally these dates and times are going to be when the device
was first inserted into the system after the last reboot.
And we're going to get to talk a lot more about that when we look at it
the system file, which is where we're going to look at next in our next course.
But you would want to make note of these dates and times.
The next sub key we're going to look at is the EMD management sub key.
Before we do that, let's just expand this so we can see we do have
another piece of information in here and that's the friendly name.
Which is going to be the volume name and the volume name here is hack tools.
So hack tools is going to be what a user named this
particular volume when they formatted it.
And that's for this top device here with the serial number and the disk ID.
The second device has a volume name.
A user created name of max storage.
Now these were not done by the manufacturer.
They would be named something else like seagate hard drive or
USB generic device or something other than what they're named.
These are names, hack tools and
max storage is something that a user put in when they formatted the drive.
So from this key we get in this case a serial number, a disk ID,
a volume name or otherwise referred to as a friendly name.
And the information for
our other USB device that we're getting is we're getting the disk ID.
We're not getting a serial number and
we're getting the volume name of max storage.
Now this device probably does not have a serial number has a number assigned by
the system.
So now we're going to take a look at our next sub key, the EMD management key.
And we're going to go ahead and use our bookmarks.
So we're going to go to our bookmarks common and
we're going to go to the EMD management sub key.
And the path of that was software Microsoft Windows NT
current version EMD management.
Underneath here, we can see we have our max storage
again that it's not the serial number.
Let's see what other information we have.
We have a last write time.
And because this device is tested when we first plug it into the system.
This is going to probably be the time the device was first inserted into the system.
And that device status we have a one so it did not pass the test for ready boost.
But that is not really what interests me here.
What interests me here is this may not be a serial number to the device but
this is the volume serial number.
This is the volume serial number which is very important and it isn't decimal.
You will probably have to convert that decimal to hex.
If you're going to search for it within your link files, it could be either stored
in decimal or hex depending on which type of forensic tool you're using.
But most of the time it's going to be in hex.
So you would need to convert that to hex.
You could use the Windows calculator to do that and
you will get a hex to decimal value.
Now looking at our hack tools,
we have hack tools and we have our disk ID number but
we do also have a serial number.
This is the serial number of the device again,
this is not the volume serial number, this is the serial number of the device.
But we did luck out with max storage and we do have a volume serial number.
And that is like getting something really good because that's going to make
it really easy for us to search within our file system and find link files.
Again, remember to convert to hex but we still have a serial number for
this device which is the actual serial number device and we have a disc ID.
And like I said before the disk ID is going to allow you to search across
the registry and find different places in the registry like the system file.
Possibly the m cache file mounted devices within
the system hive that we're going to be able to see the disk ID.
And we do have those last right times.
And again this is going to be very close to when the device was
first connected to the computer to the system.
So from the software hive we can gather information about USB
devices that were connected to the system.
And we're going to want to make note of that for our reports.
You can do that with a screenshot are just documenting it.
But you definitely want to make note of that.
And in our next of course we're going to examine the system file
which will have a lot more USB device information in there.
And we're going to want to be able to connect that information back to
the software file and validate the results that were getting in the system file.