Hello Reader:
This week another challenge met! This weeks' winner did a very nice writeup on his testing. Combined with my series, Nicole Ibrahim and this answer I think you're pretty set for handling MTP analysis for Android devices. Well done Kevin Stokes, you won a RiffBox!
The Challenge:
The Winning Answer:
Kevin Stokes
This week another challenge met! This weeks' winner did a very nice writeup on his testing. Combined with my series, Nicole Ibrahim and this answer I think you're pretty set for handling MTP analysis for Android devices. Well done Kevin Stokes, you won a RiffBox!
The Challenge:
Your suspect was identified with a Samsung Galaxy S3 device attached to his work computer on the day of his departure. On a Windows 7 system what would you do to determine the following:
1. When the phone was first and last connected
2. What was being accessed from the phone
3. If data had been copied to the phone
4. The contents of files accessed from the phone
The Winning Answer:
Kevin Stokes
I can actually look at my information from Saturday. On January 1, I did a factory restore on my laptop. It’s so nice to have a clean computer! I connected my phone for charging in the afternoon.1. When the phone was first and last connectedFirst Time Connected: Utilizing Nicole Ibrahim’s research on USB devices, I learned that the follow registry keys would have information regarding times that they were created upon device insertion. However, it may be possible that some of these are added by default and are actually related to potential events or actions that could take place at some time on the device. I’ll show an example below, but verifying against the Setupapi.dev.log would be more conclusive of the first insertion time.SYSTEM\CurrentControlSet\Control\DeviceClasses\
SYSTEM\CurrentControlSet\Control\Class\
This Snapshot of the SetupApi.dev.log shows more conclusive evidence of an MTP device being inserted at the time of interest. You can see the VID & PID match the entries in DeviceClasses above.>>> [Device Install (Hardware initiated) - USB\VID_04E8&PID_6860\8d638616]>>> Section start 2014/01/04 14:39:33.433ump: Creating Install Process: DrvInst.exe 14:39:33.438ndv: Retrieving device info...ndv: Setting device parameters...ndv: Searching Driver Store and Device Path...dvi: {Build Driver List} 14:39:33.462dvi: Searching for hardware ID(s):dvi: usb\vid_04e8&pid_6860&rev_0400dvi: usb\vid_04e8&pid_6860dvi: Searching for compatible ID(s):dvi: usb\ms_comp_mtpdvi: usb\class_06&subclass_01&prot_01dvi: usb\class_06&subclass_01dvi: usb\class_06cpy: Policy is set to make all digital signatures equal.dvi: Enumerating INFs from path list 'C:\windows\inf'inf: Opened PNF: 'C:\windows\System32\DriverStore\FileRepository\wpdmtp.inf_amd64_neutral_28f06ca2e38e8979\wpdmtp.inf' ([strings.0409])dvi: Created Driver Node:dvi: HardwareID - USB\MS_COMP_MTPdvi: InfName - C:\windows\System32\DriverStore\FileRepository\wpdmtp.inf_amd64_neutral_28f06ca2e38e8979\wpdmtp.infdvi: DevDesc - MTP USB Devicedvi: DrvDesc - MTP USB Devicedvi: Provider - Microsoftdvi: Mfg - (Standard MTP Device)dvi: ModelsSec - Generic.NTamd64dvi: InstallSec - MTPdvi: ActualSec - MTP.NTdvi: Rank - 0x00ff2000dvi: Signer - Microsoft Windowsdvi: Signer Score - INBOXdvi: DrvDate - 06/21/2006dvi: Version - 6.1.7600.16385dvi: Created Driver Node:dvi: HardwareID - USB\Class_06&SubClass_01&Prot_01dvi: InfName - C:\windows\System32\DriverStore\FileRepository\wpdmtp.inf_amd64_neutral_28f06ca2e38e8979\wpdmtp.infdvi: DevDesc - MTP USB Devicedvi: DrvDesc - MTP USB Devicedvi: Provider - Microsoftdvi: Mfg - (Standard MTP Device)dvi: ModelsSec - Generic.NTamd64dvi: InstallSec - MTPdvi: ActualSec - MTP.NTdvi: Rank - 0x00ff2001dvi: Signer - Microsoft Windowsdvi: Signer Score - INBOXdvi: DrvDate - 06/21/2006dvi: Version - 6.1.7600.16385inf: Searched 1 potential matches in published INF directoryinf: Searched 35 INFs in directory: 'C:\windows\inf'Last Time Connected: The last time connected was more difficult to determine, however after reviewing more entries, this was the latest time I discovered for this device. This was near the time I removed the device from the computer and plugged it into the wall for charging. I’m not aware of what actions created this entry, as I was unable to get this time to update with connection testing today. The registry entries I’m using for this portion of the report, by the way, were all saved prior to any testing.NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\...Device Name – Software HiveI did find out that the Microsoft\Windows Portable Devices\Devices\USB#... key updates when the Device Name changes on my Samsung Galaxy S4.Here, the first entry shows the device name I had set up (I had performed a factory reset on my phone after a troublesome software update so I changed the name after having connected my phone an earlier time). I was curious why this time was different from the install times, as Nicole mentioned this key is created initially at the time of the first device install. I changed the Device Name to TEST (SGH-M919), then rechecked the key and the time value was again changed to the time that I plugged in the phone.
2. What was being accessed from the phone?
Looking over the ShellBag entries from the UsrClass.dat. These are the folders I created for testing. The folders name “AllReadyOnDevice”, were created on the microSD card, then the card was placed into the phone to be accessed. The “CopiedFromComputer” folder was created on my computer, then copied to the microSD card, while it was being access from the phone. These entries are from when I accessed each folder while they were on the phone.
