We will use the following command to do so: Mformat command line: mformat -T 1953760 -i ok.dd -h 255 -s 63 -H 32 ::Īnother command, the fstat command, can be used to obtain general known info, such as allocation structures, layout, and boot blocks, about the device image. Use the following command to list all the drives attached to the system: This is a very crucial step, and if it is done wrong, all the work will go to waste. In this case, regular backups will not work. The first thing we will do is make a copy of the USB drive. This article will take a look at the professional procedure for performing forensics analysis on a USB device. The retrieval or recovery of deleted data from USB drives is what we call USB forensics. When incriminating information such as blackmailing is deleted from a USB device, then USB forensics will come into play to retrieve the deleted information.

to carry out malicious tasks by hackers and script kiddies. Due to the stealthy nature of these devices, USB drives can be used to store malicious and dangerous programs and files, such as packet sniffers, keyloggers, malicious files, etc. A USB (Universal Serial Bus) device provides storage capacity ranging from 2 GB to 128 GB or more. The use of USB devices to store personal data and information is increasing day by day due to the portability and the plug-and-play nature of these devices.

Oxygen forensics zip