SecurityHunk

Well!! nowadays we use our USB port to plugin many devices like mp3 players,ipods,pendrives etc,it is also very true that these devices are also vector of  many viruses,trojans and backdoors etc which can be lethal sometimes.Today  I am  going to discuss how we can keep a track of  all the USB devices that  were connected to our computer(WIN Xp / 7 / Vista).This trick can be very helpful in case you find that some data has been stolen  from your PC.

The USB history in a PC can be tracked by two methods:

a)By looking directly into the registry files.

b)Or by using Tool.

Note:Click on the images to zoom them.

Lets first start with Registry file method.

1.First open up  Run and  type "regedit"  and hit enter.

Note:USB history can be found at two places in registry

 --HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB
 --HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR

2.A registry editor  window open up,in that window follow the steps as shown in the image below.
(Here we will look into the second  registry path mentioned above but you can also try with the first one)
In the above image you can see that after I connected a pendrive and its information is present there in the registry.

So lets  see how we can do this with a tool.The tool that we will be using for this is Nirsofts's USBDVIEW. (Download)

1.Download the Tool  and just run , it will show all the devices that were connected to your PC.

Note:Serial numbers are  unique for external devices but internal devices as you can see have same serial number.

2.Now select anyone of the external device and right click on it and select Properties.It will show you all the details about the external device as shown in the image below.

Now we have retrieved the history of the USB  devices so,lets see how we can delete these history informations.

1.Open up the registry editor window as shown in the above steps then follow the on screen steps as shown in the image below.

2.After completing all the steps in the above image you will be able to delete the registry key or subkey.
By doing this the traces are removed....but still then  it can be detected so we will cover that in Part-II.

Note:For Linux  you can use USBVIEW(Download)

If you find this post  worthy enough to read do drop a comment  it will be appreciated. :)

IF YOU FIND THIS BLOG WORTH READING THEN DO "VOTE" FOR IT........

Have you ever thought  that some person would have tried to  login to your  box in your absence....lol  :) may be you are unaware of it till now and he may be planting some other trick(may be he has already read my last post lolzz) to get success!!!.
Ok today I am going to tell you how u can  track that....it is very simple,you do not need any extra software for it  if you have Mr.Gates's OS(WIN XP.7 OR VISTA) running in your box.By default that facility in disabled but i will show you how to enable it and what info it contains.
So lets start..........

1.First open  up RUN and type  Gpedit.msc as shown below and hit enter.

2.After that you will see an console window and follow the onscreen information as shown below......


3.When you reach the 7th step in the above image then double click on it to change its settings as shown below.
In the above image you can see that both the options as marked  are disabled 

a)So if you want only to log your login success then enable success  in the above image.

b)If you want to log login failures then enable failure in the above image.

c)If you want to log both login  success and failure attempts then enable both.
 After selecting your suitable option click ok.

4.Then inorder to test if it works or not,logout from your system and try few wrong passwords and  then login again.

5.Now right click on the "My computer" icon on the desktop and navigate to where it is written "Manage"

6.Now after clicking manage in the above step a new console will open and then follow the steps as illustrated in the image below.
Here you can see there are many success login attempts but there is one failure login attempt...marked as step 5,so double click on it to see the information it contains.

7.After double clicking on it  the image below shows the information in it..just give it a look.... :)
As you can see it contains the time & date,username,reason etc
I hope this will add to ur knowledge.....and you will be any day  helped by this.... :)

If you find this article interesting and worth reading so plzz  drop your comments it will be appreciated.... :)