IT Forensics – Windows

Forensic analysis of Windows MountPoints2 artefacts – evidence of connected storage devices

The MountPoints2 registry key contains information about data volumes and removable media that have been mounted under a user account. Depending on the version of Windows and how it is used, this may include references to USB-Sticks, external hard drives, network drives or other storage media.

Enquire without obligation

As part of a professional IT forensic investigation, MountPoints2 artefacts are never assessed in isolation. Only by correlating them with USB artefacts, SetupAPI logs, registry hives, ShellBags, LNK files and other digital traces is it possible to carry out a reliable technical reconstruction.

Why LanCologne?

Since its foundation, LanCologne has specialised in professional IT forensics. Our staff have decades of experience in the field of information technology and provide support to businesses, solicitors, private individuals and, on a regular basis, the courts.

The examination is carried out exclusively on a forensic copy or a forensic image. The original evidence remains unchanged and is stored in a manner that preserves its evidential integrity.

Our services

Analysis of MountPoints2 registry artefacts, reconstruction of connected storage devices, correlation with other Windows artefacts, and full documentation of all investigation steps.

Typical areas of application

•Investigation into potential data leaks
•USB forensics
•Incident Response
•Corporate Forensics
•Employment law proceedings
•Expert reports for the courts

This is how the analysis works

Once a forensic image has been created, the relevant registry artefacts are analysed and technically correlated with other digital evidence.

Why are MountPoints2 artefacts important?

They can provide information on which storage devices have been mounted under a user account, thereby aiding the reconstruction of user activities.

Frequently Asked Questions

Which data carriers can be displayed?+
Depending on the situation, these may include, amongst other things, USB-Sticks, external hard drives, network drives or other removable storage media.
Are MountPoints2 entries conclusive evidence in their own right?+
No. They are always assessed alongside other digital artefacts.
Is the original system being examined?+
No. Only a forensic copy or forensic image is analysed.
Are MountPoints2 artefacts admissible in court?+
They can form an important part of a comprehensive IT forensic investigation.

LanCologne – Windows Forensics in Cologne

LanCologne assists you in carrying out a legally admissible analysis of MountPoints2 artefacts and the objective reconstruction of digital user activities.

Get in touch now