Thumb drive unallocated space

broken image
broken image

The reason is that those involved in the civil sector often image/collect the data at the scene and then have to return the original source media, leaving with only the images. When conducting a computer forensics investigation on a USB thumb drives, in addition imaging the drive, it is recommended that the PID and Serial numbers from the USB drive are obtained, particularly for those civil sector.