0

If one uses a storage device (USB stick or SD card) on Windows, then it leaves "System Volume Information" folder in the file system. Would there be a way so a forensic guy could definitely tell on which computer the storage device was used by examining the "System Volume Information" contents?

Do other OS (Linux or Android) modify those contents automatically?

Can Windows system find out that a storage was used on other system (Windows or Linux or Android) if the other system modified the "System Volume Information" contents?

Do other OS leave something similar?

William
  • 21
  • 3
  • Other questions on the same storage traces topic: https://security.stackexchange.com/questions/257055/which-traces-leave-on-a-usb-stick-after-using-it https://security.stackexchange.com/questions/257056/which-traces-leave-on-a-flash-card-reader-after-using-it https://security.stackexchange.com/questions/257059/which-traces-leave-on-a-flash-card-after-using-it https://security.stackexchange.com/questions/257060/are-there-differences-on-how-storages-are-formatted-between-different-os – William Nov 14 '21 at 09:08

0 Answers0