Australian Digital Forensics Conference

Document Type

Conference Proceeding


School of Computer and Information Science, Edith Cowan University, Perth, Western Australia


Flash and USB portable drives are now in common place use in computing environments. The U3 smart drive is one emerging type of enhanced flash drive. It is believed that U3 smart drive devices do not leave any record or evidence on a host PC after use. Therefore, it is conceivable that it could be used in a digital crime or attack on a computer or networked system. In circumstances where a portable device such as a U3 has been used, it is more complex for a forensic analyst to find evidence of its use. This paper discusses the impact of U3 smart drive devices on a forensic investigation. Further, it describes the forensic investigation undertaken of a computer in which U3 was used.


Originally published in the Proceedings of the 6th Australian Digital Forensics Conference, Edith Cowan University, Perth Western Australia, December 3rd 2008.