USB设备盗窃文件案的分析与鉴定

The Using USB Devices Theft Files Case Evidence Appraisal and Analysis

该文章针对一起利用USB设备(U盘)盗窃文件案的证据分析与鉴定工作,给出了分析鉴定过程和鉴定中应注意的问题,通过对该案件电子取证的鉴定思路、鉴定过程以及鉴定的启示等三个方面来进行探讨,并介绍了USB设备描述符的确定、USBStor注册表键的分析、USB设备接入系统时盘符的分析和USB设备接入操作系统最初时间的确定等研究方法。文章对于当前的USB设备的电子证据鉴定工作具有一定的指导意义。

The article on the use of USB equipment（U disk file） theft case analysis and identification of the work,gives the analysis process and the identification of problems should be paid attention to,through the case of electronic evidence identification method,identification and identification on three aspects to carry on the discussion,and introduced the USB device descriptor determination of registry keys,USBStor analysis,USB equipment access system drive and the analysis of USB equipment access operating system originally time determination methods.The article for the current USB device of electronic evidence identification work has certain guiding significance.