USB Write Blocking and Forensics

In recent years USB mass storage devices using NAND flash storage (also known as thumb drives or flash drives) have replaced magnetic media, such as floppy discs, and optical media, such as CD/DVD, as the standard means for backup and file exchange. The ultimate aim is to understand how to perform forensics on USB mass storage devices. In order to achieve this one must first understand the basics of USB devices. The first part of this chapter will cover the basics of USB. From there we will move on to learn more about USB mass storage devices. Once the foundations have been set we will cover some advanced topics such as USB write blocking and device impersonation. The chapter concludes with a discussion of BadUSB and methods of protecting from this and other similar attacks.