Quantcast
Channel: Forensic Focus Forums - Recent Topics
Viewing all articles
Browse latest Browse all 20109

General Discussion: USBSTOR Analysis

$
0
0
jaclaz wrote: sward6 wrote: And just to use this as a learning point for myself, the way I would read that, is it being two separate usb storage devices (with two different serial numbers) of the same make/model. Am I correct assuming this? Yes, but no (to be picky). <img src="images/smiles/icon_eek.gif" alt="Shocked" title="Shocked" /> It may be the same device been connected twice, one before and one after the serial change (there are "Manufacturer Production Tools" around that can do that). For some sticks there are also "recovery" tools from the Manufacturer, to be used if the device fails or becomes "read only" or gets in a "0 byte size" assertion, I never noticed/took note if using any of them the serial was changed or remained the same. Usually on "Manufacturer Production Tool" there is a setting like: auto-number set number keep current number and the recovery tools which are often "stripped down" versions of the MTP may have the first option set. As well, though unlikely and irrelevant, it could be once (or twice) a "real" Kingston Data Traveler SE9 and once (or twice) a "fake" one. jaclaz Thanks for the explanation!

Viewing all articles
Browse latest Browse all 20109

Trending Articles