The Impact Of U3 Devices On Forensic Analysis.

Document Type

Conference Proceeding


Computing, Health and Science


Computer and Information Science, Centre for Security Research




This article was originally published as: Tank, R. & Williams, P. (2008). The Impact of U3 Devices on Forensic Analysis. Proceedings of the 6th Australian Digital Forensics Conference, (pp. 197-203). Perth, Western Australia. : SECAU _ Security Research Centre, ECU. Original article available here


Flash and USB portable drives are now in common place use in computing environments. The U3 smart drive is one emerging type of enhanced flash drive. It is believed that U3 smart drive devices do not leave any record or evidence on a host PC after use. Therefore, it is conceivable that it could be used in a digital crime or attack on a computer or networked system. In circumstances where a portable device such as a U3 has been used, it is more complex for a forensic analyst to find evidence of its use. This paper discusses the impact of U3 smart drive devices on a forensic investigation. Further, it describes the forensic investigation undertaken of a computer in which U3 was used.