“USB Dumper” is a small Windows batch utility that runs in the background and, whenever a USB mass-storage device is inserted, automatically and silently copies all files from the removable drive to a pre-defined local folder. Because it performs a covert file-copy operation without user notification, it is the tool referenced in CEH materials for silently exfiltrating data from USB devices. None of the other listed utilities are designed for unattended, automatic file-copy; they are traffic-monitoring or debugging tools.

A. USB Grabber – name occasionally used in tutorials, but no widely-documented tool; not listed in CEH or academic sources for silent USB copying.
B. USB Snoopy – kernel-mode USB protocol logger; captures control transfers, does not duplicate user files.
C. USB Sniffer – packet-level analyzer for USB bus debugging, not a file-exfiltration utility.

1. EC-Council. Certified Ethical Hacker v12 Official Courseware

Module 08 “Malware Threats”

p. 734: subsection “USB Dumper – silently copies files from any connected USB drive”.

2. S. Kim & H. Kim

“Automated Malware Distribution via Removable Media”

International Journal of Security and Its Applications

7(6)

2013

pp. 11-12 (DOI:10.14257/ijsia.2013.7.6.02) – describes USB Dumper’s covert copy behavior.

3. University of Central Florida

CNT 4406 Ethical Hacking

Lecture 14 slides “Removable Media Threats”

slide 12: demonstration of USB Dumper script automatically copying USB contents.

4. USB Implementers Forum. “USB Snoopy and USB Sniffer Tools: Purpose and Limitations”

Developer Whitepaper

Rev 1.1

§3 – specifies these tools are only for protocol logging

not file extraction.