Comments on Computer Forensics, Malware Analysis & Digital Investigations: EnScript to obtain connected USB devices from Syst...

HI David, Some of the reg hives that are collecte...

2009-12-14T22:18:21.328-08:00

HI David,

Some of the reg hives that are collected in the System Volume information are partial hives, meaning they dont have all the keys and values of a regular hive. So it appears that you are running across a hive that does not have some of the keys that are needed to determine or get the USB information.

Here is an updated version to only process selected hives in the System Restore Point. If you have any additional trouble, just email me: lance(at)forensickb.com

http://www.lancemueller.com/blog/USB%20Device%20History%20-%20System%20Volume%20Information%20-%20Selected%20Only.EnPack

Hi Lance, This is David Shin, I worked with you a...

2009-12-13T16:24:14.069-08:00

Hi Lance,

This is David Shin, I worked with you at Guidance. I am trying to run your USB Device History - System Volume Information enpack but I get the following error message in the output tab:

"35880BB8E71ACA4D956E6E303B44FA0B" does not exist, USB Device History - System Volume Information (10,42)

Any feed back would be appreciated. Hope all is well with you.

thank you.

David

Mr. Mueller, I am using EnCase version 6.14.3.4 an...

2009-11-01T09:23:43.961-08:00

Mr. Mueller, I am using EnCase version 6.14.3.4 and I was trying to use your provided EnScript - I'm trying to match up an external drive with my suspect computer. Here are the results when using the enscript. Any assistance would be appricated. Regards, Sgt. Robert Salter forensic@cityofrichfield.org or rsalter@cityofrichfield.org.

Error: Reference to null EntryClass object, Specialized Scripts\USB Device History - System Volume Information(53,0)
Name: USB Device History - System Volume Information
Status: Error
Start: 11/01/09 11:18:44AM
Stop: 11/01/09 11:18:45AM
Time: 0:00:01