Folder created automatically on newly bought USB stick
I have bought a brand new USB Stick of the same type I often buy (Intenso Slim Line). Usually these USB sticks are empty, so it's not pre-loaded with software or something.
However, this time, when I inserted the USB stick, it immediately had a folder on it with the name of one of my clients. I have last dealt with this client about 3 weeks before.
First I thought this is a caching issue, so I pressed F5 (nothing happened) and removed the USB stick and inserted it again. The folder is still there.
I have then used FTK Imager Lite to have a look at the physical contents of the USB stick. I could clearly find the long folder name and short folder name. The creation date is today.
How could this folder be created on the USB stick?
I could imagine some special case where the serial number of this USB stick is identical to the one 3 weeks before. Does Windows complete copy operations or similar at a later time, even weeks later?
That happened on Windows 7 Professional SP1, all updates installed.
The only other software I have installed and that I hold for suspect being capable of doing this is Acronic TrueImage. It creates a new tab in Explorer called "Acronis Recovery". Is it know to do stuff like that?
windows-7 usb-flash-drive forensics
asked Dec 24 '18 at 10:39
Thomas WellerThomas Weller
3,01063061
add a comment |
I have bought a brand new USB Stick of the same type I often buy (Intenso Slim Line). Usually these USB sticks are empty, so it's not pre-loaded with software or something.
However, this time, when I inserted the USB stick, it immediately had a folder on it with the name of one of my clients. I have last dealt with this client about 3 weeks before.
First I thought this is a caching issue, so I pressed F5 (nothing happened) and removed the USB stick and inserted it again. The folder is still there.
I have then used FTK Imager Lite to have a look at the physical contents of the USB stick. I could clearly find the long folder name and short folder name. The creation date is today.
How could this folder be created on the USB stick?
I could imagine some special case where the serial number of this USB stick is identical to the one 3 weeks before. Does Windows complete copy operations or similar at a later time, even weeks later?
That happened on Windows 7 Professional SP1, all updates installed.
The only other software I have installed and that I hold for suspect being capable of doing this is Acronic TrueImage. It creates a new tab in Explorer called "Acronis Recovery". Is it know to do stuff like that?
windows-7 usb-flash-drive forensics
asked Dec 24 '18 at 10:39
Thomas WellerThomas Weller
3,01063061
add a comment |
I have bought a brand new USB Stick of the same type I often buy (Intenso Slim Line). Usually these USB sticks are empty, so it's not pre-loaded with software or something.
However, this time, when I inserted the USB stick, it immediately had a folder on it with the name of one of my clients. I have last dealt with this client about 3 weeks before.
First I thought this is a caching issue, so I pressed F5 (nothing happened) and removed the USB stick and inserted it again. The folder is still there.
I have then used FTK Imager Lite to have a look at the physical contents of the USB stick. I could clearly find the long folder name and short folder name. The creation date is today.
How could this folder be created on the USB stick?
I could imagine some special case where the serial number of this USB stick is identical to the one 3 weeks before. Does Windows complete copy operations or similar at a later time, even weeks later?
That happened on Windows 7 Professional SP1, all updates installed.
The only other software I have installed and that I hold for suspect being capable of doing this is Acronic TrueImage. It creates a new tab in Explorer called "Acronis Recovery". Is it know to do stuff like that?
windows-7 usb-flash-drive forensics
asked Dec 24 '18 at 10:39
Thomas WellerThomas Weller
3,01063061
I have bought a brand new USB Stick of the same type I often buy (Intenso Slim Line). Usually these USB sticks are empty, so it's not pre-loaded with software or something.
However, this time, when I inserted the USB stick, it immediately had a folder on it with the name of one of my clients. I have last dealt with this client about 3 weeks before.
First I thought this is a caching issue, so I pressed F5 (nothing happened) and removed the USB stick and inserted it again. The folder is still there.
I have then used FTK Imager Lite to have a look at the physical contents of the USB stick. I could clearly find the long folder name and short folder name. The creation date is today.
How could this folder be created on the USB stick?
I could imagine some special case where the serial number of this USB stick is identical to the one 3 weeks before. Does Windows complete copy operations or similar at a later time, even weeks later?
That happened on Windows 7 Professional SP1, all updates installed.
The only other software I have installed and that I hold for suspect being capable of doing this is Acronic TrueImage. It creates a new tab in Explorer called "Acronis Recovery". Is it know to do stuff like that?
windows-7 usb-flash-drive forensics
windows-7 usb-flash-drive forensics
asked Dec 24 '18 at 10:39
Thomas WellerThomas Weller
3,01063061
asked Dec 24 '18 at 10:39
Thomas WellerThomas Weller
3,01063061
asked Dec 24 '18 at 10:39
Thomas WellerThomas Weller
3,01063061
asked Dec 24 '18 at 10:39
Thomas WellerThomas Weller
3,01063061
asked Dec 24 '18 at 10:39
Thomas WellerThomas Weller
3,01063061
3,01063061
add a comment |
add a comment |
0
active
oldest
votes
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "3"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1387354%2ffolder-created-automatically-on-newly-bought-usb-stick%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
0
active
oldest
votes
0
active
oldest
votes
active
oldest
votes
active
oldest
votes
Thanks for contributing an answer to Super User!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1387354%2ffolder-created-automatically-on-newly-bought-usb-stick%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
