Understanding stored evidence on USB devices

Let’s dive into MTP and find out more about it. On personal computers, we often come across USB device classes known as MTP and PTP. These protocols are commonly utilized by a range of devices, including mobile phones, tablets, cameras, scanners, and music players. Unlike standard storage devices that fall under MSC, MTP and PTP offer a subset of capabilities. Consequently, the operating system treats them differently, recognizing their unique characteristics and functionalities. To identify a USB device we can check SYSTEM\<CurrentControlSet>\Enum\USB and SOFTWARE\Microsoft\Windows Portable Devices\Devices.

On the other hand, MSC is a transfer protocol that facilitates communication between a computer and a USB device. It enables the mounting of the USB device’s storage area, granting direct access to these data areas for reading and writing. This allows users to conveniently view the internal filesystem structure...