0

If one uses a micro SD card with a card reader on Windows, or on Linux, or on Android - would there be a way so a forensic guy could definitely tell on which computer the flash card was used by examining it?

I know OS can log which devices was connected. As far as I know the log is saved locally to OS, not to the removable devices.

Also I know about files metadata which may leak system info. Let's not consider that.

Also Windows leaves "System Volume Information" folder in the file system. Don't know though could it be used to track down the system or not. Don't know do other OS leave something similar. Going to ask it in a separate question.

So is there any other way OS can leave traces on flash cards?

It may sound silly, but for example by writing some data to flash card memory directly to some sectors offset without registering it in a file system.

Or by storing something in the file system metadata, let's consider FAT32.

William
  • 21
  • 3
  • Other questions on the same storage traces topic: https://security.stackexchange.com/questions/257055/which-traces-leave-on-a-usb-stick-after-using-it https://security.stackexchange.com/questions/257056/which-traces-leave-on-a-flash-card-reader-after-using-it https://security.stackexchange.com/questions/257060/are-there-differences-on-how-storages-are-formatted-between-different-os https://security.stackexchange.com/questions/257062/could-system-volume-information-be-used-to-find-out-on-which-system-the-storag – William Nov 14 '21 at 09:11

0 Answers0