When an employee resigns to join a competitor or faces disciplinary action, the risk of data exfiltration escalates sharply. In high-stakes employment disputes and corporate investigations, solicitors and general counsel frequently face assertions that confidential client lists, pricing models, or intellectual property were copied to external storage. The commercial imperative is immediate: establish whether data was taken, identify precisely which files were targeted, and secure admissible evidence to support undertakings, a springboard injunction, or civil proceedings.
Proving data exfiltration requires far more than identifying that an external drive was inserted into an endpoint. Windows endpoints create numerous interlocking artefacts whenever hardware connects, volumes mount, and files are manipulated. Crucially, copying a file to a removable storage drive does not change the file's 'Last Modified' timestamp on the host machine. Legal teams that rely on standard file system metadata alone will miss the transfer entirely. A forensic investigation must correlate multiple operating system artefacts to construct a defensible chronology of device connection, volume mounting, user attribution, and document interaction.
Core Forensic Artefacts of USB Device Connection
Windows maintains several registry hives and system logs that record the attachment of Universal Serial Bus mass storage devices. When an investigator examines an endpoint, the primary objective is to extract the unique hardware footprint of any device connected during the relevant period of interest.
The USB and USBSTOR Registry Keys
The first point of inquiry lies within the SYSTEM registry hive at HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR. This key records the device class, manufacturer, product name, firmware revision, and the device serial number for every USB storage device ever connected to the machine. If the hardware vendor failed to write a unique serial number, the operating system assigns a globally unique identifier (GUID) containing an ampersand (&) in the second character position, indicating an OS-generated identifier.
Complementing this is the parent key at HKLM\SYSTEM\CurrentControlSet\Enum\USB, which records vendor identification (VID) and product identification (PID) codes. These hardware markers allow an investigator to confirm whether a device subsequently seized or disclosed matches the exact physical device connected during the suspect incident.
SetupAPI Log Files
To establish the exact timeline of the first and subsequent device installations, forensic examiners rely on the setup log located at C:\Windows\INF\setupapi.dev.log. This log records the operating system's driver installation process when a new peripheral connects. It records the first installation timestamp in UTC, the specific hardware identifiers, and the subsequent operational status. Comparing this log against registry entries confirms when the device was first introduced to the endpoint.
MountedDevices and MountPoints2
A physical drive may contain one or more logical volumes. The HKLM\SYSTEM\MountedDevices key maps the hardware serial number and volume signature to a logical drive letter (such as E: or F:). In addition, the MountPoints2 key within the user-specific NTUSER.DAT hive records which user profile was active when that drive letter was mounted. This link is vital in environments where multiple individuals share an endpoint or service accounts exist.
Proving File Interaction and Exfiltration
Connecting a USB storage device does not, on its own, prove that proprietary data was copied onto it. In litigation, respondents frequently argue that the drive was used solely for charging a mobile phone, listening to personal music, or storing personal photographs. Digital forensics must bridge the evidentiary gap between device connection and file interaction.
LNK Files and Recent Documents
When a user opens, modifies, or accesses a file, Windows automatically creates a shortcut file with a .lnk extension within the user profile (specifically inside AppData\Roaming\Microsoft\Windows\Recent). These link files contain granular metadata, including:
- The original file path, including the drive letter where the document resided.
- Target file timestamps (Created, Modified, Accessed).
- The Volume Serial Number (VSN) of the storage medium hosting the target document.
- The volume name and drive type (e.g., removable storage).
If a link file points to drive letter E:, displays a Volume Serial Number matching the suspect USB drive, and relates to a confidential company file, this provides compelling evidence that the file was opened from, or saved directly onto, that external drive.
Jump Lists
Introduced to track user activity in taskbars and applications, Jump Lists exist in two formats: AutomaticDestinations and CustomDestinations. Located within the user profile, these compound files record which applications accessed specific files, alongside access timestamps. Jump Lists often contain references to files that no longer exist on the primary hard drive, proving that an employee opened files directly from the removable device shortly before departing the company.
Shellbags and Folder Traversal
Shellbags are stored within the user registry hives (specifically USRCLASS.DAT). They preserve viewing preferences, window sizes, and positions for folders viewed within Windows Explorer. Shellbags persist even after folders are deleted, renamed, or after the external drive is detached. When an investigator analyses Shellbags, they can prove that a specific employee navigated directory structures located exclusively on the external drive, identifying folder hierarchies that correspond to confidential business units.
The USN Journal and $LogFile
The NTFS Master File Table ($MFT) and Update Sequence Number (USN) Journal document changes to files on the host drive. While copying a file from an internal drive to an external drive does not modify the source file's record, mass copying often causes file reads that update the Last Accessed date (if access timestamping is enabled), or creates temporary staging folders. Users frequently aggregate sensitive files into a single directory, create a compressed archive (such as a ZIP or RAR container), move the container to the USB, and subsequently delete the staging folder. The USN Journal preserves the record of this temporary file creation, compression, and rapid deletion, directly contradicting claims of normal operational work.
Attributing Activity to the Departing Employee
Establishing what happened on an endpoint is insufficient if the legal team cannot prove who sat at the keyboard. In employment and corporate misconduct disputes, defendants regularly raise defences alleging remote tampering, malware, or unauthorised colleague access.
Attribution requires triangulating operating system artefacts with corporate access records:
- User Hive Segregation: Registry artefacts such as
NTUSER.DAT,USRCLASS.DAT, and user-specific LNK directories reside inside individual user profile folders. The artefacts generated during the USB connection exist specifically within the suspect's profile. - Windows Event Logs: The Security Event Log records logon sessions. Event ID 4624 (Successful Logon) specifies the Logon Type. Type 2 indicates physical console access, distinguishing local keyboard interaction from remote access (Type 10) or network shares (Type 3).
- Physical and Access Control Systems: Forensic timelines must be cross-referenced with building access badge swipes, CCTV records, and Active Directory authentication logs. Demonstrating that the employee badged into the building at 08:45, logged on locally via Event ID 4624 at 08:47, and connected an unauthorised USB device at 08:52 leaves minimal room for plausible denial.
Practical Steps: The Investigation Protocol
When counsel suspects data exfiltration via removable media, adhering to an established procedural workflow preserves evidentiary integrity under the ACPO Principles for Digital Evidence. The following steps should govern the preliminary response:
- Isolate the Machine: Remove the device from the network immediately to prevent remote wiping, automated software updates, or scheduled maintenance scripts from overwriting transient artefacts. Do not shut down the computer abruptly if volatile memory (RAM) has not yet been acquired.
- Capture Volatile Memory: Memory contains active processes, uncommitted network connections, and mounted volume keys. If BitLocker or third-party encryption is present, capturing memory can be critical for recovering keys or unencrypted volume records.
- Acquire a Forensic Image: Take a full, bit-stream physical image (E01 or raw format) of the storage media, verifying hardware integrity using cryptographic hash functions (SHA-256). Work exclusively on forensic clones, never on the original machine.
- Extract Device Signatures: Query
USBSTOR,setupapi.dev.log, and mounted volume registries to generate a complete inventory of every removable device connected to the machine during the suspect's employment. Compile a target schedule of Device Serial Numbers and Volume Serial Numbers. - Demand Production of Specific Hardware: Armed with exact serial numbers, model names, and connection timestamps, instructing solicitors can serve targeted letters of claim or apply for search orders that demand delivery up of the specific physical devices, removing the respondent's ability to provide a decoy drive.
- Produce an Expert Witness Statement: Detail the findings in a clear, objective report suitable for the court, explaining technical artefacts in plain language and adhering strictly to Part 35 of the Civil Procedure Rules where court proceedings are active.
Integrating USB Forensics into the eDiscovery Workflow
USB forensics should not operate in an analytical vacuum. The findings of a digital forensics investigation directly inform and accelerate the downstream eDiscovery workflow under Practice Direction 57AD (PD 57AD) or CPR Part 31.
Scoping Identification and Preservation
Forensic triage identifies which document repositories were compromised. Rather than conducting wide, costly collections across an entire corporate file server, USB artefacts (such as LNK files and Shellbag histories) delineate the exact folders the departing employee accessed. This enables focused, defensible preservation notices and targeted data collections, reducing processing overheads.
Cross-Referencing Disclosed Devices in Processing
If the respondent surrenders the suspect USB drive pursuant to undertakings or an order of delivery up, that physical drive is imaged and ingested into the eDiscovery platform. Forensic examiners calculate MD5 or SHA-256 cryptographic hashes of every file on the surrendered drive. These hashes are cross-referenced against the master collection extracted from the company's file systems.
Exact hash matches confirm that the files on the external device are byte-for-byte duplicates of the corporate assets. In addition, comparing the surrendered drive's internal Volume Serial Number and hardware serial number against the endpoint's registry artefacts confirms whether the produced device is the actual device used during the exfiltration event, or an empty substitute presented to mislead the claimant.
Analysis and Review under PD 57AD
In the Disclosure Review Document (DRD), the parties must agree on appropriate search parameters, date ranges, and custodian lists. The objective data provided by USB forensic analysis provides hard justification for Model C (request-led) or Model D (search-based) disclosure requests. When seeking disclosure of personal email accounts or personal cloud storage, exhibiting forensic proof that an employee plugged in a non-whitelisted device and transferred specific corporate files provides the necessary factual foundation to defeat proportionality objections raised by the other side.
Defensible Reporting for Legal Action
A rigorous forensic inquiry transforms circumstantial suspicions into documented, objective fact. By linking hardware serial numbers, user profiles, file system shortcuts, and external volume structures, digital forensics provides the evidentiary weight required to secure undertakings, obtain injunctive relief, and successfully conclude insider threat disputes.