

This key also contains USB connected device information. WHAT? The difference has to do with how the device identifies to the computer. But that is a conversation for another day. It turns out that the number being referred to as the serial number is very much an arbitrary value, and I don’t just mean “serial numbers” with an ampersand (&) as the second character. #Apple serial number finally forensic analysis serial number#

We were told that this meant the value was generated by the computer at the time of insertion, and not from the factory when the USB device was built.

Oh, and it gets worse! It seems that the serial numbers reported above (no matter which ones you pick), are often not even the actual device serial number! It turns out this is not exactly correct. #Apple serial number finally forensic analysis serial numbers# To demonstrate this, I conducted a number of tests against 3 different USB devices. The first device I tested was a bare 2.5” Seagate drive.
