Interpret USB Date/Time Field from RR

Autopsy Help
1

I have a several USB devices from the “recent activity” ingest module and the fields all show a date of 2/16 or 2/20. Looking at the file meta data and the output of RR I have one date for created and either of the above dates for modified, accessed, or MFT modified for everything including a wheel mouse and keyboard…

How should that be interpreted - I don’t think they were all (94) were connected on one day…

Thanks for any help.

2

More then likely the date/time(s) have been updated because of a MS update. I do not have a source for this at my fingerprints but it is something to start to research, was there a Windows update applied around that time.

3

Hi Bob,

I have not faced this situation but, had some thing related to USB devices.
I have posted at List of USB Devices used
Your case may be helpful in verify my observation,
Can you please parse the event logs and search the USB devices serial number you have , then you may be able to discover how many times times a USB device plugged in to the PC,

I discovered it once and posted in forum but did not got any comment,
Your situation may validate my observations.

Regards

4

I have looked through the EVTX files and unfortunately there is not a reference to the USB device in the log; the EVTX file for ‘partitions’ was not there. I just the logging for that event was not turned on.

This was a Win 7 device if that makes a difference for the logging.

Thanks for the help,

Bob

5

Hi
I was having windows 10, it was a corporate investigation.
below is the parsed result from one of the event file

Name event #103269
Item # 1182726
Ext
Path Image.E01/Basic data partition (3)/Windows [NTFS]/[root]/Windows/System32/winevt/Logs/Microsoft-Windows-Storage-ClassPnP%4Operational.evtx/event #103269
Category Windows Evtx Event
Created 2018-11-02 14:10:32 UTC
Accessed n/a
Modified n/a
Event Data <Data Name=DeviceGUID">{A9B1A85C-C040-3304-E9CE-A70E8A95BA88}<Data Name=DeviceNumber">2<Data Name=Vendor">Seagate <Data Name=Model">BUP Slim BL <Data Name=FirmwareVersion">0304<Data Name=SerialNumber">N*******<Data Name=IrpStatus">0xc0000185<Data Name=IoctlControlCode">0x74080

It might be possible that is event was logged because of some corporate policy.

Thanks for your comment

Regards