Can You Prove A USB Drive Was Connected

USBCONNECTIONEVIDENCE · A GUIDE FOR UK LAWYERS Can You Prove a USB Drive Was Connected? The Registry Trail, the Serial Number, the Timeline: and What Connection Does Not Prove COMPUTER FORENSICS LAB

§ CONTENTS In this guide 01 Executive summary 02 The problem in plain English: one stick, one after no on, one question 03 The artefact stack: where connection is recorded 04 Identifying the specific device: serials and volume identity 05 Timing: first, last and in-between connections 06 From connection to files: what access evidence adds 07 What connection evidence does not prove 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist

§ 01 · ORIENTATION Executive summary THE HEADLINE POINT: CONNECTIONISPROVABLE; MEANINGISBUILT

§ 02 · FIRST PRINCIPLES The problem in plain English: one stick, one after no on, one question

§ 03 · THERECORDERS The artefact stack: where connection is recorded RECORDER WHAT IT HOLDS, AND ITS ROLE IN THE PROOF

§ 04 · WHICHSTICK Identifying the specific device: serials and volume identity

§ 05 · WHEN Timing: first, last and in-between connections

§ 06 · FROMPRESENCETOCOPYING From connection to files: what access evidence adds

§ 07 · THEEDGES What connection evidence does not prove

§ 08 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE EXAMINED PCS THE DEVICE TOOLING (DLP / BACKUP S DELETED / PC (SAME ITSELF DEVICE OF THE PC RECOVERABLE OTHER CORPORATE SERIAL) CONTROL)

§ 09 · IN THE WILD Worked examples EXAMPLE1 · THESERIALTHATCROSSEDTHREEMACHINES EXAMPLE2 · THECONNECTIONTHATWASITALLALONG EXAMPLE3 · THEREFORMATTHATDATEDITSELF

§ 10 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations

§ 11 · INTERROGATORIES & DRAFTING AIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your e Discovery / forensic provider SUGGESTED WORDING · INSTRUCTIONFORUSBCONNECTIONANA LY SIS

§ 12 · QUICK CONTROL Checklist and red flags · When to involve a digital forensic expert The USB evidence checklist Red flags When to involve a digital forensic expert

§ 13 · COMMON QUESTIONS Frequently asked questions How certain is device identification, really? Can someone delete the connection records? The connection was two years ago. Too late? He says the stick was for personal photos. How is that tested? Do phones connected by cable show up like memory sticks? What single step most strengthens a USB case?

§ 14 · REFERENCE Glossary Sources and authoritative references DISCLAIMER

§ HOW A SPECIALIST LABORATORY CAN ASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY