Knowing that a key was modified at a specific time is very helpful, but it can be even more helpful to understand either what values and data are beneath that key, or what was actually modified. Perhaps my most prevalent use of WRR is to use it in conjunction with other analysis processes, such as to view the values and data within a specific key of interest during timeline analysis (more information regarding timeline analysis will be presented later in the chapter). Something else that’s very useful about WRR is that with the “Raw Data” view open, you can right-click on a key, choose “Properties,” and view information about the key, such as the index, the relative offset of the key structure within the hive file, and the LastWrite (or “Date Modified”) time. I’ve used this search functionality to look for globally unique identifiers (GUIDs), key and value names, as well as portions of text that may occur within value data.

When the search is complete, any hits will be displayed in the bottom-most pane in the WRR user interface, and double-clicking on any of the hits will cause that location to be opened for viewing. Depending upon how large the hive file is, the search can take several minutes. Once the dialog is open, enter your search term, select what structures you want searched (keys, values, data), and click “Find Next”. Nicole Ibrahim has conducted research about MTP devices as a series of blog posts, which can be found at. Check your computer forensic tool feature list for such functions. However, there are some forensic tools that can reveal such connected devices. What we want to conclude from this brief discussion is that USB devices connected through a MTP connection do not leave traces on the previously mentioned USB storage device registry keys. If Windows ® requests a file, the phone will respond by sending the file over the MTP connection. Instead the Android device will only allow Windows ® to have access to a short list of media files that Windows ® can see. For example, when an Android smartphone is connected to a computer running Windows ® using the MTP, the Android device will not expose its contents to Windows ® as USB mass storage, allowing it to have access to its raw file system. New Android versions, Windows phones, and Blackberry all use this protocol, which does not leave traces in Windows registry keys we already talked about. Some modern USB devices use a media transfer protocol (MTP) when connecting with computers. Note that not all USB devices are connected and leave traces in Windows registry as we already described.

The second date appears: Created Date represents the last time that the same device was attached to the system. This date does not change when the same device is repeatedly reinserted.

6.49, the Last Plug/Unplug Date represents the first time that the device was connected to the system. Using USBDeview to view USB hard drive artifacts.

Do ativador do windows 7