> ## Documentation Index
> Fetch the complete documentation index at: https://rootea.es/llms.txt
> Use this file to discover all available pages before exploring further.

# USB forensics

> Recursos cross-platform para USB forensics: máquinas HTB, labs PortSwigger y rooms TryHackMe curados, con writeups validados y skills relacionadas.

# USB forensics

Esta página agrega los **recursos para practicar USB forensics** de forma cross-platform: máquinas retiradas de Hack The Box, labs de PortSwigger Web Security Academy y rooms de TryHackMe, más recursos curados (HackTricks, PortSwigger, etc.) y skills relacionadas.

## Recursos curados

| Fuente     | Enlace                                                                                                                                                             |
| ---------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| HackTricks | [https://book.hacktricks.wiki/en/forensics/basic-forensic-methodology/index.html](https://book.hacktricks.wiki/en/forensics/basic-forensic-methodology/index.html) |

## Máquinas HTB que practican USB forensics (1)

| Máquina                                  | SO    | Dificultad                                       |
| ---------------------------------------- | ----- | ------------------------------------------------ |
| [Mirai](/htb/machines/linux/facil/mirai) | Linux | <span className="dbadge dbadge-easy">EASY</span> |

## Rooms TryHackMe que practican USB forensics (39)

| Room                                                                                         | Dificultad                                         | Tipo        | Acceso  | Oficial                                                                   |
| -------------------------------------------------------------------------------------------- | -------------------------------------------------- | ----------- | ------- | ------------------------------------------------------------------------- |
| [Advent of Cyber 2022](/tryhackme/rooms/adventofcyber4)                                      | <span className="dbadge dbadge-easy">EASY</span>   | Walkthrough | 🟢 Free | [Abrir](https://tryhackme.com/room/adventofcyber4)                        |
| [Advent of Cyber 2023](/tryhackme/rooms/adventofcyber2023)                                   | <span className="dbadge dbadge-easy">EASY</span>   | Walkthrough | 🟢 Free | [Abrir](https://tryhackme.com/room/adventofcyber2023)                     |
| [Android Analysis](/tryhackme/rooms/androidanalysis)                                         | <span className="dbadge dbadge-easy">EASY</span>   | Walkthrough | 🔵 VIP  | [Abrir](https://tryhackme.com/room/androidanalysis)                       |
| [DFIR: An Introduction](/tryhackme/rooms/introductoryroomdfirmodule)                         | <span className="dbadge dbadge-easy">EASY</span>   | Walkthrough | 🟢 Free | [Abrir](https://tryhackme.com/room/introductoryroomdfirmodule)            |
| [Digital Forensics Fundamentals](/tryhackme/rooms/digitalforensicsfundamentals)              | <span className="dbadge dbadge-easy">EASY</span>   | Walkthrough | 🔵 VIP  | [Abrir](https://tryhackme.com/room/digitalforensicsfundamentals)          |
| [Ice](/tryhackme/rooms/ice)                                                                  | <span className="dbadge dbadge-easy">EASY</span>   | Walkthrough | 🟢 Free | [Abrir](https://tryhackme.com/room/ice)                                   |
| [Intro to Cold System Forensics](/tryhackme/rooms/introtocoldsystemforensics)                | <span className="dbadge dbadge-easy">EASY</span>   | Walkthrough | 🟢 Free | [Abrir](https://tryhackme.com/room/introtocoldsystemforensics)            |
| [Intro to Digital Forensics](/tryhackme/rooms/introdigitalforensics)                         | <span className="dbadge dbadge-easy">EASY</span>   | Walkthrough | 🟢 Free | [Abrir](https://tryhackme.com/room/introdigitalforensics)                 |
| [iOS Forensics](/tryhackme/rooms/iosforensics)                                               | <span className="dbadge dbadge-easy">EASY</span>   | Walkthrough | 🔵 VIP  | [Abrir](https://tryhackme.com/room/iosforensics)                          |
| [macOS Forensics: The Basics](/tryhackme/rooms/macosforensicsbasics)                         | <span className="dbadge dbadge-easy">EASY</span>   | Walkthrough | 🟢 Free | [Abrir](https://tryhackme.com/room/macosforensicsbasics)                  |
| [MAL: REMnux - The Redux](/tryhackme/rooms/malremnuxv2)                                      | <span className="dbadge dbadge-easy">EASY</span>   | Walkthrough | 🔵 VIP  | [Abrir](https://tryhackme.com/room/malremnuxv2)                           |
| [Malware Analysis - Malhare.exe](/tryhackme/rooms/htapowershell-aoc2025-p2l5k8j1h4)          | <span className="dbadge dbadge-easy">EASY</span>   | Walkthrough | 🟢 Free | [Abrir](https://tryhackme.com/room/htapowershell-aoc2025-p2l5k8j1h4)      |
| [Memory Analysis Introduction](/tryhackme/rooms/memoryanalysisintroduction)                  | <span className="dbadge dbadge-easy">EASY</span>   | Walkthrough | 🟢 Free | [Abrir](https://tryhackme.com/room/memoryanalysisintroduction)            |
| [Memory Forensics](/tryhackme/rooms/memoryforensics)                                         | <span className="dbadge dbadge-easy">EASY</span>   | Challenge   | 🟢 Free | [Abrir](https://tryhackme.com/room/memoryforensics)                       |
| [NetworkMiner](/tryhackme/rooms/networkminer)                                                | <span className="dbadge dbadge-easy">EASY</span>   | Walkthrough | 🔵 VIP  | [Abrir](https://tryhackme.com/room/networkminer)                          |
| [Yara](/tryhackme/rooms/yara)                                                                | <span className="dbadge dbadge-easy">EASY</span>   | Walkthrough | 🔵 VIP  | [Abrir](https://tryhackme.com/room/yara)                                  |
| [AI Forensics](/tryhackme/rooms/aiforensics)                                                 | <span className="dbadge dbadge-easy">MEDIUM</span> | Walkthrough | 🟢 Free | [Abrir](https://tryhackme.com/room/aiforensics)                           |
| [Forensics - Registry Furensics](/tryhackme/rooms/registry-forensics-aoc2025-h6k9j2l5p8)     | <span className="dbadge dbadge-easy">MEDIUM</span> | Walkthrough | 🟢 Free | [Abrir](https://tryhackme.com/room/registry-forensics-aoc2025-h6k9j2l5p8) |
| [IR Timeline Analysis](/tryhackme/rooms/dfirtimelineanalysis)                                | <span className="dbadge dbadge-easy">MEDIUM</span> | Walkthrough | 🟢 Free | [Abrir](https://tryhackme.com/room/dfirtimelineanalysis)                  |
| [KAPE](/tryhackme/rooms/kape)                                                                | <span className="dbadge dbadge-easy">MEDIUM</span> | Walkthrough | 🟢 Free | [Abrir](https://tryhackme.com/room/kape)                                  |
| [Legal Considerations in DFIR](/tryhackme/rooms/dfirprocesslegalconsiderations)              | <span className="dbadge dbadge-easy">MEDIUM</span> | Walkthrough | 🟢 Free | [Abrir](https://tryhackme.com/room/dfirprocesslegalconsiderations)        |
| [Linux Forensics](/tryhackme/rooms/linuxforensics)                                           | <span className="dbadge dbadge-easy">MEDIUM</span> | Walkthrough | 🔵 VIP  | [Abrir](https://tryhackme.com/room/linuxforensics)                        |
| [Linux Live Analysis](/tryhackme/rooms/linuxliveanalysis)                                    | <span className="dbadge dbadge-easy">MEDIUM</span> | Walkthrough | 🔵 VIP  | [Abrir](https://tryhackme.com/room/linuxliveanalysis)                     |
| [Linux Server Forensics](/tryhackme/rooms/linuxserverforensics)                              | <span className="dbadge dbadge-easy">MEDIUM</span> | Walkthrough | 🟢 Free | [Abrir](https://tryhackme.com/room/linuxserverforensics)                  |
| [Secret Recipe](/tryhackme/rooms/registry4n6)                                                | <span className="dbadge dbadge-easy">MEDIUM</span> | Walkthrough | 🔵 VIP  | [Abrir](https://tryhackme.com/room/registry4n6)                           |
| [Security Footage](/tryhackme/rooms/securityfootage)                                         | <span className="dbadge dbadge-easy">MEDIUM</span> | Challenge   | 🟢 Free | [Abrir](https://tryhackme.com/room/securityfootage)                       |
| [Session Forensics](/tryhackme/rooms/sessionforensics)                                       | <span className="dbadge dbadge-easy">MEDIUM</span> | Walkthrough | 🟢 Free | [Abrir](https://tryhackme.com/room/sessionforensics)                      |
| [Volatility Essentials](/tryhackme/rooms/volatilityessentials)                               | <span className="dbadge dbadge-easy">MEDIUM</span> | Walkthrough | 🟢 Free | [Abrir](https://tryhackme.com/room/volatilityessentials)                  |
| [Web Attack Forensics - Drone Alone](/tryhackme/rooms/webattackforensics-aoc2025-b4t7c1d5f8) | <span className="dbadge dbadge-easy">MEDIUM</span> | Walkthrough | 🟢 Free | [Abrir](https://tryhackme.com/room/webattackforensics-aoc2025-b4t7c1d5f8) |
| [Windows Applications Forensics](/tryhackme/rooms/windowsapplications)                       | <span className="dbadge dbadge-easy">MEDIUM</span> | Walkthrough | 🔵 VIP  | [Abrir](https://tryhackme.com/room/windowsapplications)                   |
| [Windows Forensics 1](/tryhackme/rooms/windowsforensics1)                                    | <span className="dbadge dbadge-easy">MEDIUM</span> | Walkthrough | 🟢 Free | [Abrir](https://tryhackme.com/room/windowsforensics1)                     |
| [Windows Forensics 2](/tryhackme/rooms/windowsforensics2)                                    | <span className="dbadge dbadge-easy">MEDIUM</span> | Walkthrough | 🔵 VIP  | [Abrir](https://tryhackme.com/room/windowsforensics2)                     |
| [Windows User Account Forensics](/tryhackme/rooms/windowsuseraccountforensics)               | <span className="dbadge dbadge-easy">MEDIUM</span> | Walkthrough | 🔵 VIP  | [Abrir](https://tryhackme.com/room/windowsuseraccountforensics)           |
| [Windows User Activity Analysis](/tryhackme/rooms/windowsuseractivity)                       | <span className="dbadge dbadge-easy">MEDIUM</span> | Walkthrough | 🔵 VIP  | [Abrir](https://tryhackme.com/room/windowsuseractivity)                   |
| [XDR: Defense Evasion](/tryhackme/rooms/xdrdefenseevasion)                                   | <span className="dbadge dbadge-easy">MEDIUM</span> | Walkthrough | 🔵 VIP  | [Abrir](https://tryhackme.com/room/xdrdefenseevasion)                     |
| [Forensics](/tryhackme/rooms/forensics)                                                      | <span className="dbadge dbadge-easy">HARD</span>   | Challenge   | 🟢 Free | [Abrir](https://tryhackme.com/room/forensics)                             |
| [Lost in RAMslation](/tryhackme/rooms/lostinramslation)                                      | <span className="dbadge dbadge-easy">HARD</span>   | Challenge   | 🔵 VIP  | [Abrir](https://tryhackme.com/room/lostinramslation)                      |
| [macOS Forensics: Applications](/tryhackme/rooms/macosforensicsapplications)                 | <span className="dbadge dbadge-easy">HARD</span>   | Walkthrough | 🔵 VIP  | [Abrir](https://tryhackme.com/room/macosforensicsapplications)            |
| [macOS Forensics: Artefacts](/tryhackme/rooms/macosforensicsartefacts)                       | <span className="dbadge dbadge-easy">HARD</span>   | Walkthrough | 🟢 Free | [Abrir](https://tryhackme.com/room/macosforensicsartefacts)               |

***

← [Volver al glosario completo](/glosario)

<script type="application/ld+json">
  {`{"@context":"https://schema.org","@type":"DefinedTerm","name":"USB forensics","termCode":"usb-forensics","inLanguage":"es","url":"https://rootea.es/skills/usb-forensics","inDefinedTermSet":{"@type":"DefinedTermSet","name":"Glosario táctico de pentesting","url":"https://rootea.es/glosario"}}`}
</script>

<script type="application/ld+json">
  {`{"@context":"https://schema.org","@type":"ItemList","name":"Máquinas HTB que practican USB forensics","numberOfItems":1,"itemListElement":[{"@type":"ListItem","position":1,"url":"https://rootea.es/htb/machines/linux/facil/mirai","name":"Mirai"}]}`}
</script>

*Última actualización: 2026-05-09*