USB Storage Research Articles

First Steps to Improve Cybersecurity Behaviour – a Virtual Reality Experience

Internet is completely integrated and absorbed in our life. Facilitating transfer of files across the world or wiring money from the couch, we could not imagine a world without it anymore. With these benefits, as with any new technology, there is also the introduction of risks and threats, for internet primarily in the form of cybercrime and online fraud. To reduce victimisation of this cybercrime, interventions are used to teach people to not perform risky behaviour. To overcome criticisms of current training materials, such as being tedious and boring, we created an Immersive Virtual Reality experience. By using a 4-step design process (i.e. ideation, specification, realisation, and evaluation), we designed a playful VR environment with simplistic non player characters to train the user to perform basic cybersecurity tasks in the right way. In the simulation, the participants are exposed to the challenge of creating a new password and a potential ransomware attack using USB storage device. The program allows for monitoring the user’s cybersecurity knowledge and behaviour and provides feedback. An evaluation of the VR environment among 16 respondents using a pretest-posttest evaluation with the Human Aspect Information Security Questionnaire (HAIS-Q) showed a statistically significant increase in scores after exposure to the VR environment. The system showed an above average SUS score. These initial findings indicate that a VR environment can be an alternative to consider for future development of cybersecurity interventions. Future research could expand our social VR environment with additional cybersecurity challenges, real-time actors, and running simulations among a broader audience to also investigate the retention of knowledge and skills.

FieldPrism: A system for creating snapshot vouchers from field images using photogrammetric markers and QR codes.

Field images are important sources of information for research in the natural sciences. However, images that lack photogrammetric scale bars, including most iNaturalist observations, cannot yield accurate trait measurements. We introduce FieldPrism, a novel system of photogrammetric markers, QR codes, and software to automate the curation of snapshot vouchers. Our photogrammetric background templates (FieldSheets) increase the utility of field images by providing machine-readable scale bars and photogrammetric reference points to automatically correct image distortion and calculate a pixel-to-metric conversion ratio. Users can generate a QR code flipbook derived from a specimen identifier naming hierarchy, enabling machine-readable specimen identification for automatic file renaming. We also developed FieldStation, a Raspberry Pi-based mobile imaging apparatus that records images, GPS location, and metadata redundantly on up to four USB storage devices and can be monitored and controlled from any Wi-Fi connected device. FieldPrism is a flexible software tool designed to standardize and improve the utility of images captured in the field. When paired with the optional FieldStation, researchers can create a self-contained mobile imaging apparatus for quantitative trait data collection.

DiagAnalyzer: User behavior analysis and visualization using Windows Diagnostics logs

Windows Diagnostics, which is used by default in Windows 10 and Windows 11, records basic device information as well as various detailed user activities of those who use Windows. Previously, there have been several preceding studies that attempted to apply diagnostics information to digital forensics analysis, but there have been no practical methods or publicly available tools to analyze data in relation to user behavior. Therefore, this paper analyzed how three representative activities (attaching and detaching USB storage devices, web browser activities, and wireless network activities) are recorded in Window Diagnostics. Furthermore, based on the analysis results, we developed DiagAnalyzer, which automatically analyzes the diagnostics event log and visualizes the user's behavior. Through the methodology and tool of this paper, the application of Windows Diagnostics deserves further attention as an important artifact in digital forensics investigation for Windows in the future.

Forensic Investigation of Remnant Data on USB Storage Devices Sold in New Zealand

The digital forensic tools used by law enforcement agencies for forensic investigations are mostly proprietary and commercially expensive; although open-source tools are used, the investigations conducted with such tools are not verified by reputable organisations, and hence, users are reluctant to practice such tools. To address this issue, we experimentally evaluate three open-source forensic tools based on various requirements recommended by the National Institute of Standards and Technology (NIST) framework for forensic investigation. The experimental setup consists of a forensic workstation, write-blocker, and purchased USB hard drives investigated via digital forensic imaging tools, i.e., DC3DD, DCFLDD, and Guymager. We create various test cases, which distribute USB hard drives in different groups and investigate the functional and optional requirements of NIST along with recovering and analysing remnant data. We evaluate these forensic tools by analysing the log information, following, anonymously (to ensure that data were not disclosed or misused during or after the investigations) collecting, examining, and classifying the remnant data restored from the USB hard drives. We observe that the percentage of hardware resources usage and the processing time of each tool are remarkably different, e.g., Guymager was the fastest tool and met all the functional requirements in each test case, but it utilised more CPU and memory resources than DC3DD, DCFLDD. We note that 88.23% of the USB hard drives contained sensitive personal or business information (e.g., personal photos, bank transactions, and contracts). Subsequently, the remnant data analysis shows that consumers in New Zealand are unaware of personal data security and the associated vulnerabilities of data leakages.

Modular Distance Learning: The Problem and Its Background

Modular Distance Learning involves individualized instruction that allows learners to use self-learning modules (SLMs) in print or digital format/electronic copy, whichever is applicable in the context of the learner, and other learning resources like Learner’s Materials, textbooks, activity sheets, study guides and other study materials. Learners access electronic copies of learning materials on a computer, tablet PC, or smartphone. CDs, DVDs, USB storage and computer-based applications can all be used to deliver e-learning materials, including offline E-books. The teacher takes the responsibility of monitoring the progress of the learners. The learners may ask assistance from the teacher via e-mail, telephone, text message/instant messaging. Where possible, the teacher shall do home visits to learners needing remediation or assistance. Any member of the family or other stakeholder in the community needs to serve as para-teachers.

An Empirical study to determine the role of file-system in modification of hash value

In digital forensics, maintaining the integrity of digital exhibits is an essential aspect of the entire investigation and examination process, which is established using the technique of hashing. Lack of knowledge, while handling digital exhibits, might lead to unintentional alteration of computed hash, rendering the exhibit unacceptable in the court of Law. The hash value of a physical drive does not solely depend upon the data files present in it but also its file-system. Therefore, any change to the file-system might result in the change of the disk hash, even when the data files within it remain untouched. In this paper, our objective is to study the role of file-system in modification of the hash value. We examine and analyse the changes in the file-system of a NTFS formatted USB storage device, which leads to modification in its hash value when the device is plugged-in to the computer system without using write-blocker. The outcome of this research would justify the importance of write blockers while handling digital exhibits and also substantiate that the alteration in hash value of a storage device might not be an indication that data within the device has been tampered with.

Consciousness about Mobile App Permissions

This paper gives us the attentiveness on opening files from unknown sources as sometimes it may cause damage to our mobile phones. In almost all the mobile apps after downloading it will ask some of the permissions to allow clicking for the allow button only we can able to access anything in that application otherwise we are unable to use all the features of that application. Many popular android apps including Facebook messenger, WhatsApp, Skype, Twitter, Share it, Instagram and other party apps get user permission after the installation. By allowing these permissions they can recording with the phone audio and video at any time, they can see contacts and modifying the USB storage contents(files). Lack of knowledge and awareness about permissions to the people may cause significant negative consequences. This research evaluates effectiveness of a demo app with visual ques to increase permissions awareness and avoid negative consequences.

An Authentication and Data Protection Scheme Research for Mass Storage Devices

Universal serial bus mass storage is a widely used storage device. In order to protect the user data security in USB storage devices, an effective authentication and data protection scheme is proposed. Using the attribute-based control technology, the security authentication of the USB device user is realized, and the privacy data fine-grained control of the USB device is realized. Security analysis shows that the scheme has strong security, it can resist replay attack, denial of service attack, the online password guessing attack, user impersonation attack, etc. Experimental performance analysis shows that the scheme has high efficiency in user registration, authentication and file decryption.

Case Based Interpretation of Windows 10 Registry Forensics

With the advancement in computer technologies, cybercrimes advanced too. As in today’s world, the technology knowledge to attack a computer is less than ever, with the help of advanced tools that does most of the work. Digital forensic investigations are crucial in solving this type of crimes, and it must be done professionally. Computer registries play a big part in the digital forensic investigation, it can help find artifacts that are left by the cybercrimes, dates of the crimes on the computer system and the user at the time of the crime. In this research, interpretation of these artifacts is the main focus, committees and jurors are the focus of the interpretations of the registries. Two types of cases are subject to investigation in this research. BitTorrent clients’ use for downloading illegal o copyrighted content, and three clients are chosen for this digital forensic investigation uTorrent, Vuze and BitComet. Theft using USB storage devices is the second type of case, where there are three types of USB devices Mass Storage Class, Picture Transfer Protocol and Media Transfer Protocol, each type of USB devices leaves different artifacts behind during insertion and removal. A web based dashboard will be developed to help with the process of interpretation the artifacts found in the registry of the computer system. A categorization process of each cybercrime case will be conduct to evaluate the severity of the case depending on the artifacts found in the digital forensics investigation process. The research methodology will consist of three phases. The first phase will be information gathering including literature review, requirements gathering and dataset gathering for the research. Performing digital forensics analysis will be the second phase and it includes planning, identification and reconnaissance. Last phase will include result analysis and discussion.

An investigation into remnant data on USB storage devices sold in Australia creating alarming concerns

USB storage devices, also known as USB sticks, pen drives, flash drives, thumb drives, and key drives, have replaced many other portable storage media. USB devices are popular given their robustness, low power consumption, rapid response rates, non-volatile nature, capacity, and ease of transportation. However, the data on these devices are most often unsecured and not deleted when disposed of. Using a quantitative and case study method to assess the extent and potential impact of the problem, this study obtained second-hand USB devices, purchased from eBay Australia to determine the data and erasure status of the devices using forensic acquisition and analysis techniques. Where data fragments were recovered, the volume and potential sensitivity of were investigated. The findings from the research show that in most cases, the USB devices held a large volume of data, were owned by both individuals and organizations, and were used to store highly sensitive and confidential data. This data were neither permanently nor securely destroyed prior to disposal (by sale) of the devices. Such incidents highlight the failure to meet regulatory obligations regarding privacy legislation in Australia. The paper provides recommendations for secure disposal of data from USB devices.

Portable Storage Device Management in Linux

The world of information technology and communication is moving towards standardization of hardware ports. All kind of communication is now using USB as the port as it is universally recognized hardware medium of data communication. It is become flexible and easy to use kind of things with portable USB storage devices to copy data from one system to another system. It is possible to copy data within seconds with the help of portable USB flash memory devices. It has leaded insecurity of data storage on computer system. Various surveys has shown after network copy only USB data copy has made data insecure on computer . It is also the source of malwares in the system. To disable the USB ports is not the solution to this problem because almost all peripheral devices now uses the USB ports for communication. So, we have implemented a system which has complete USB storage enable and disable control for Linux operating system. The administrator will decide the storage devices connected to USB must be enabled or disabled . We experimented the algorithm on Linux kernel version 3.11 onwards on Debian based linux distributions. We have got 100% success rate of the said system with zero percent performance degradation.

Secure USB Design Using Unallocated Arbitrary Area

In the paper we proposed advanced methods of USB security software using file system recomposition and unassigned arbitary disk area. It provides data confidentiality of the USB storage device in the Windows OS using forced disk partition division by offering the real time data password in secure area. The confidentiality is also served by using user login verification and saving encoded the hash value at the unassigned arbiraty disk partition.

Fuzzy Crime Investigation Framework for Tracking Data Theft based on USB Storage

Since the lives of the persons are on the edge after being convicted in digital crimes. The main goal of digital forensics is to extract accurate evidence which determines whether the convict is guilty or not. The recent challenge is due to the big size of data that the investigator may deal with. These data stored in unnoticeable tiny devices such as USB sticks which may lead to a muddled decision because of the tediousness of the investigation. Fortunately, in Windows Operating systems, all users' transactions are stored in a central point which is known as Windows Registry. It stores all hardware and software configurations, user activities, and transactions. Therefore, digital forensics based on Windows registry is considered as a hot research field. This paper presents a proposed framework for digital crime investigation based on Fuzzy logic. It helps the investigator in the decision making phase about the evidence. This deals with the extracted evidence from relevant Windows Registry keys. Also, tracking the usage of USB devices for data theft was presented. Finally the proposed framework was tested on a simulated case study.

Design of an Intelligent Point-to-Point Swing Arm Controller

The point-to-point swing arm test is very important for large arms which have swing arm movement. Traditional point-to-point swing arm controller is relay control mode. The mode has many shortcomings, such as big volume, high power consumption, low stability, and so on. An intelligent point-to-point swing arm controller, using MCU as the control core, was designed for this reason. It was mainly composed of switch signal detecting module, solenoid valve drive module, USB storage interface module and MCU control module. According to the requirements of test, the controller was able to detect the valid signal of limit switch and control commutation operation of solenoid valve, meanwhile it could record the movement time between one point and another point, the time the arm swayed and the moment information, and these above information would be stored in USB memory. It has some advantages of small size, low power consumption, high stability and flexible functions.

On the detection of pod slurping attacks

Time is recognised to be a dimension of paramount importance in computer forensics. In this paper, we report on the potential of identifying past pod slurping type of attacks by constructing a synthetic metric based on information contained in filesystem timestamps. More specifically, by inferring the transfer rate of a file from last access timestamps and correlating that to the characteristic transfer rate capabilities of a suspicious USB found in the Windows registry, one could assess the probability of having suffered an unauthorised copy of files. Preliminary findings indicate that file transfer rates can be associated with the make and model of the USB storage device and give supporting information to the forensic analyst to identify file leakages.

Securing Pocket Hard Drives

Today, affordable storage media comes in various form factors with a wide range of capacities. USB is the most popular PC interface, offering data transfer rates as high as 480 Mbps (version 2.0), with enough power to operate storage devices such as 2.5" hard-disk drives. The Fire Wire interface offers similar capabilities. A few vendors offer software that lets users synchronize their email and network folders with USB storage. This lets them access these data items from several different computers. The U3 industry consortium promotes a model that lets users run programs, such as a Firefox Web browser, directly from the USB storage device, so users can access these applications even on PCs that don't have these applications preinstalled. Similarly, commonly used live CD-ROMs let you boot a PC from an OS resident on the CD-ROM. In this new mobile computing model called portable storage-based personalization, users can personalize a computer by booting from the USB storage media. Users' portable storage devices act as a pocket hard drive.

USB & other portable storage device usage: Be aware of the risks to your corporate data in order to take pre-emptive and/or corrective action

USB memory sticks and other Portable Storage Devices (PSD) such as, PDAs and smart phones are now widely available. Most employees will use some form of PSD at work (be it their own device or a company device). Either way, these devices are used by employees to store company data such as employee details, e-mail, corporate documents, third party sensitive data, company directories and business calendars. Therefore, some data transfer may potentially bypass traditional security measures and policies. This obviously impacts on how businesses comply with the legislation, especially Data Protection. In this context how should businesses track, monitor and control the use of PSD, flow of data between the corporate network and PSDs; and what constitutes security best practice to deal with these new threats? Should the use of USB devices be fully banned? What are the other security considerations to take into account for organizations to be prepared for issues arising out of the use of USB and other PSDs?

Tracking USB storage: Analysis of windows artifacts generated by USB storage devices

When a USB storage device, such as a thumb drive, is connected to a Windows system, several identifiers are created on the system. These identifiers, or artifacts, persist even after the system has been shut down. In many cases, these artifacts may be used for forensics purposes to identify specific devices that have been connected to the Windows system(s) in question.