Full Report
Discover how USB artifacts enhance tracking user activities on files, examining the influence of operating systems, file systems, and applications on these crucial data traces.
Analysis Summary
# Research: USB Artifacts: Analyzing User Activity and File Interactions
## Metadata
- **Authors:** Group-IB Digital Forensics & Incident Response Team
- **Institution:** Group-IB
- **Publication:** Group-IB Blog / Technical Research
- **Date:** 2024 (Original research period contextualized to current forensic standards)
## Abstract
This research examines the forensic digital footprint left by USB storage devices across various operating systems (Windows, Linux/Kali, macOS) and file systems (NTFS, FAT32, exFAT, HFS+). The study focuses specifically on "temporary files" as volatile but crucial artifacts for proving that a file was accessed, modified, or tampered with on a removable drive.
## Research Objective
The study aims to determine how different combinations of Operating Systems (OS) and File Systems (FS) influence the creation and persistence of forensic artifacts when a user interacts with files on a USB device. The primary question is: *Can temporary file artifacts reliably prove file access and modification even if the original file's metadata is unreliable?*
## Methodology
### Approach
The researchers employed a controlled experimental approach using two primary test cases:
1. **TC1:** Open and close a file without making modifications.
2. **TC2:** Open, modify, and close a file.
### Dataset/Environment
The testing environment spanned multiple platforms to observe cross-platform behavior:
- **OS:** Windows 10/11, Kali Linux, macOS.
- **File Systems:** NTFS, FAT32, exFAT, HFS+.
- **Applications:** Office suites (e.g., Microsoft Word) and text editors.
### Tools & Technologies
- Disk imaging and forensic analysis tools (for $LogFile and SQLite database analysis).
- System monitoring tools to track real-time file creation/deletion.
## Key Findings
### Primary Results
1. **Application Dependency:** The creation of temporary artifacts is heavily dependent on the application (e.g., MS Word creates `~$` prefix files, while others do not).
2. **Metadata Limitations:** FAT32 remains a "forensic blind spot" for access times, as it does not natively store access timestamps.
3. **macOS "Sidecar" Files:** macOS consistently creates "._" prefixed files on non-native file systems (FAT32/exFAT) which serve as vital indicators of interaction.
4. **NTFS Journaling:** On Windows/NTFS, the `$LogFile` provides a high-fidelity record of temporary file creation even after the file itself is deleted.
### Supporting Evidence
- **Table 2 Data:** Shows that for TC1 (Open/No save), NTFS and exFAT provide access time evidence via temp files, whereas FAT32 provides none.
- **Database Logs:** On Kali Linux, file versioning databases (`db.sqlite`) were found to record entries even when physical temporary files were purged.
### Novel Contributions
- Systematic mapping of cross-OS behavior (e.g., how a Windows-formatted NTFS drive behaves when plugged into a Kali Linux machine).
- Identification of the "._" file naming convention as a primary tracking mechanism for macOS interactions on external media.
## Technical Details
The research highlights the importance of **Journaling and Versioning**:
- **Windows NTFS:** Utilizes the `$LogFile` to record the transactional creation of hidden temporary files. Even if a user "Timestomps" the main file, the $LogFile entries for the temporary file creation typically remain unaltered.
- **Linux (Kali):** Interactions are often logged in local application versioning databases.
- **macOS:** Uses the `db.sqlite` versioning database to track changes, providing a secondary source of truth beyond the file system's metadata.
## Practical Implications
### For Security Practitioners
- Temporary files are often more reliable than the original file's MAC (Modified, Accessed, Created) times, which are easily manipulated by attackers.
### For Defenders
- **Actionable Insight:** Monitor for the creation of hidden files (starting with `~$` or `._`) on removable media as a proxy for data exfiltration or unauthorized document review.
### For Researchers
- There is a need for deeper study into how modern "Live" collaboration tools (like OneDrive/Teams) influence these local USB artifacts when files are synced across devices.
## Limitations
- **Volatility:** Temporary files are often deleted immediately after the application closes. If the drive is heavily used after the event, these deleted artifacts are quickly overwritten.
- **Application Specificity:** The research notes that not all applications create temporary files, meaning the absence of an artifact does not strictly prove a file was *not* accessed.
## Comparison to Prior Work
While traditional forensics focuses on Registry keys (like `USBSTOR`) to prove a device was *connected*, this research builds on that by focusing on what was *done* to specific files, bridging the gap between device connection and user intent.
## Real-world Applications
- **Insider Threat Investigations:** Proving a departing employee opened specific sensitive documents on a personal USB.
- **Legal Proceedings:** Using temporary file timestamps to refute claims that a file was "accidentally" modified.
## Future Work
- Analysis of encrypted containers (e.g., VeraCrypt) on USB drives and whether they leak metadata to the host OS.
- Investigating the impact of USB 3.2 and USB4 high-speed write cycles on the recovery rate of deleted temporary artifacts.
## References
- Group-IB Digital Forensics Services: [https://www.group-ib.com/services/digital-forensics/](https://www.group-ib.com/services/digital-forensics/)
- Forensic Artifact Mapping: [https://www.group-ib.com/blog/usb-artifacts-tracking/](https://www.group-ib.com/blog/usb-artifacts-tracking/) (Defanged)