Analysis of USB Flash Drives in a Virtual Environment

This paper is a continuation of our previous work [1] in which we proposed an approach where two environments, conventional and virtual, are used independently in the forensic analysis of computer systems. We discuss the use of virtual environments in the analysis of USB flash drives in computer forensics investigations. After briefly introducing general concepts of a virtual environment and software tools we show how this approach can be successfully used in the analysis phase of the computer forensics investigation of portable USB flash drives. We also show why virtualisation technique can complement but not completely replace conventional methods of computer evidence analysis.