USB Forensics

USB devices, especially flash drives, have become commonplace. As a result, USB storage devices are frequently a part of forensic investigations. An easy way of making forensic copies of USB storage devices is needed to facilitate such investigations. This course centers around building an inexpensive pocket forensic duplicator based on the FTDI Vinculum II microcontroller. You will learn the basics of making forensic copies of USB mass storage devices no matter the method employed. While building this device you will also learn how to use microcontrollers and interface with standard electronic peripherals such as LEDs and LCD displays. When you've finished this course, you will have a basic understanding of the Vinculum II microcontroller, which you can apply to more advanced applications such as USB write blocking and device impersonation, which are to be covered in a follow-up course. Software required: Freely available Vinculum II Integrated Development Environment (Windows XP or higher, possibly in a virtual machine). Hardware Required: FTDI V2DIP2 64-pin development module, 5 LEDs of 3 colors (optional), 16x2 LCD display (optional), and prototyping board (optional).