0

Starting from this great script offered by Daniel Azuelos

cd /Volumes/suspicious_USB
/usr/bin/sudo find . -atime -21 -exec ls -dluT {} \;

How is it possible to modify it in order to find if a USB flash was plugged in, on any random computer, on a certain date?

Improve this question
0

1 Answer 1

Reset to default
-1

In Linux, there is a USB subsystem which creates system log events.

So it can tell you what was plugged into your PC. But it can’t in general tell whether it's a USB stick or something else connected to a PC, unless some files were changed. While USB sticks and SD cards are usually formatted as VFAT for compatibility, there’s no reason they can’t be formatted with a more powerful filesystem such as EXT3 or NTFS. In which case, if a USB stick was mounted read-write and not “noatime”, the file access timestamp would indicate if a file had been read, or if a directory had been accessed by a graphical desktop to create folder icons.

Since this is built-in to Linux and is part of the USB specification, it must be possible to get the same level of detail in other operating systems using an appropriate application.

Improve this answer

Not the answer you're looking for? Browse other questions tagged .