1

If one uses a micro SD card with a card reader on Windows, or on Linux, or on Android, would there be a way to forensically determine on which computer the card reader was used?

I know OS can log which USB devices was connected. As far as I know the log is saved locally to OS, not to the USB devices.

Is there any way OS can leave traces on card readers?

It may sound silly, but for example by storing something in the card reader's controller chip firmware memory.

schroeder
  • 123,438
  • 55
  • 284
  • 319
William
  • 21
  • 3
  • Other questions on the same storage traces topic: https://security.stackexchange.com/questions/257055/which-traces-leave-on-a-usb-stick-after-using-it https://security.stackexchange.com/questions/257059/which-traces-leave-on-a-flash-card-after-using-it https://security.stackexchange.com/questions/257060/are-there-differences-on-how-storages-are-formatted-between-different-os https://security.stackexchange.com/questions/257062/could-system-volume-information-be-used-to-find-out-on-which-system-the-storag – William Nov 14 '21 at 09:10
  • 1
    Wait, you want to know about the ***reader*** and not the media itself? it will depend on the reader. I'm not sure if any reader would capture that data since it's not clear what benefit that might serve. – schroeder Nov 15 '21 at 15:08
  • Does this answer your question? [Which traces leave on a USB stick after using it?](https://security.stackexchange.com/questions/257055/which-traces-leave-on-a-usb-stick-after-using-it) – kelalaka Nov 15 '21 at 20:00

0 Answers0