Tackling the U3 trend with computer forensics

A new technology has emerged, allowing applications to be stored and run on portable devices, such as flash drives and iPods. Sandisk's U3™ smart technology appears to be becoming the standard in this new realm of portability. With the advent of this technology, questions are arising as to the effects it will have on computer forensic investigations. Probably hundreds of thousands of people have purchased devices with U3 or similar technologies already. The fear is that these people will be able to plug their devices into computers, do their misdeeds and then simply unplug those devices, removing any trace. This article will illustrate that this is not the case and will discuss different artifacts that a device such as this will leave behind. For the purposes of this illustration we have investigated the use of some of the most common applications used on U3 drives. This information will serve as a guide to investigating computer crimes perpetrated via U3 or similar technologies. Investigators must keep in mind during their investigations the possibility that their suspects have used such technology, particularly when their investigations seem to lead to a dead end.