Hacker Tools : Part 95
I've just discovered a handy
hacker tool that copies the contents of any inserted USB drive. It does
so automatically and stealthily, not just duplicating existing files
but actually imaging the entire device.Imaging of course means copying everything - including deleted files. Its author claims to have recovered confidential documents, software, music and pictures their owner thought they'd long ago wiped. Of course it's also a good way of backing up a USB drive.
Executing the program - called USBDumper - appears to do nothing. In the background however it starts a process on the system that watches and waits for a USB drive to be plugged in. On spotting one, it silently images the drive to a folder named with today's date.
I'll leave a consideration of the consequences of installing USBDumper on a shared or publicly accessible PC up to you. But you can spot it - and kill it - by doing a Ctrl-Alt-Del and checking the process table.
Just another reason to be careful out there...
USBDumper, complete with Windows executable, source code and a Powerpoint presentation (in French) is available here.

PC World is New Zealand’s top selling computing and technology magazine.
Comments
Can it tell the difference between "flash based" USB drives and "HDD" based units? I mean what would it do if I plugged in my 200GB USB storage drive? Would it try to copy it over to a folder on the (probably smaller) C:/ ?
Posted by: Chris | September 8, 2006 11:54 AM
Well, it comes with source code... ;-)
Posted by: Geoff Palmer | September 5, 2006 8:46 AM
What about a linux version? :P
Posted by: Daniel | September 1, 2006 6:16 PM