4

I have an image of an SD card and I am doing analysis on it. Is there any way to find that on which system this SD card was used last time.

The image I am having is of a SDHC and has FAT32 as file system.

does SD card saves the System information of the system in which they were connected or mounted.

Blaze
  • 41
  • 3
  • there is a possibility to get the info going backwards: windows caches the media serials. – dandavis Apr 24 '17 at 22:18
  • Yeah, We can get the information if we have access to the system. We can use Registry keys like USB, USBSTOR, MountedDevices and all to map the USB drives or memory card used on that particular system. But in this case I just have the forensics image of the memory card. So I was just thinking if there is any way to find the system information from this image. – Blaze Apr 25 '17 at 02:05

1 Answers1

2

AFAIK, there isn't a reliable, universal way to detect the last device a usb drive was plugged into. The best you can do is infer it from the modification times of system-specific file metadata (e.g. thumbs.db on Windows, .DS_Store on Mac) or recycle bin folders ($Recycle.Bin on Windows, .Trash-xxxx on some Linuxes).

Lie Ryan
  • 31,089
  • 6
  • 68
  • 93
  • Thankx, yeah the problem is the memory card is not having any system specific metadata file. The card contains some word and xlsx files.is it possible to determine the information about the system using the metadata of these files. – Blaze Apr 24 '17 at 11:03
  • @Blaze: docx and xlsx usually [saves the name of the last account that modifies the file](http://forensicswiki.org/wiki/Word_Document_(DOCX)) in the docProps/core.xml inside the docx/xlsx file. However, this can be trivially spoofed and it may not record them if you don't modify the file. – Lie Ryan Apr 24 '17 at 11:13