BACKGROUND
People leaving their employment and consultants leaving their clients often make copies of information that they have produced together with other "good to keep" information, e.g., financial reports, spreadsheets, customer databases, internal templates, source code/scripts, drawings, copyright protected images, network design, etc. An easy way of making copies is by copying the digital information to a USB storage device. By doing so, the security mechanisms of the computer network will not react.
From experience based on more than 800 digital forensics investigations, we would like to share some important facts concerning a common problem within the field of civil law / labor law / intellectual property law.
As digital forensics specialists, we often see extra activities concerning the use of new USB storage devices just before an individual is leaving. From a digital forensics view, it is very hard (in most cases impossible) to tell exactly how many files that have been copied to a USB device. Especially if a folder including files and other sub-folders are copied. Microsoft Windows does not include this information in any kind of log file. In 90% of all cases, we can only confirm technical proof of file copy activities and NOT tell exactly what have been copied.
By having USB2Log installed, you will get all the digital facts you need.
PRODUCT
USB2Log is a background service for use in a Microsoft Windows environment. It will add logging functionality to complement Windows built-in logging features with detailed information about the use of USB storage devices. It has a specific focus concerning file copying activities. All log posts are encrypted and stored in a standalone database file. The log posts as well as the database file are protected against manipulation. You can install USB2Log on laptops, workstations as well as servers.
Key concepts
- Adds detailed logging functionality in Windows concerning the use of USB storage devices.
- Gives a hint about the user's purpose of using the USB storage device.
- All activities are stored in real-time and are associated with a username.
- The standalone database including the log posts is encrypted.
- All clients get a unique pair of encryption keys.
- The database content can be exported to a Excel, CSV, TSV or JSON file.
- Easy to install (MSI installation).
- No external dependencies.
Monitoring
Listens to USB storage activities only.
No graphical user interface
This is a background service.
Encryption
All log data are protected by very strong encryption.
Decryption
Two alternatives;
Default - by Dingard only
Extra - by the client's organization
Protection
USB2Log has a built-in integrity check to reveal log data manipulation.
Asymmetric keys
Strong protection based on a public and a private key.
Performance
Very fast.
(A laptop with 16 GB RAM takes ~3 minutes including time for compression)
Delivery
An easy to read Excel, CSV, TSV or JSON text file.