Can You Prove A USB Drive Was Connected

USBCONNECTIONEVIDENCE · AGUIDEFORUKLAWYERS Can You Prove a USB Drive Was Connected? The Registry Trail, the Serial Number, the Timeline: and What Connection Does Not Prove COMPUTERFORENSICSLAB § ABOUTTHEAUTHOR PRE PA REDBYCOMPUTERFORENSICSLABE - DISCOVERYTEAM § CONTENTS In this guide 01 Executive summary 02 The problem in plain English: one stick, one afternoon, one question 03 The artefact stack: where connection is recorded 04 Identifying the specific device: serials and volume identity 05 Timing: first, last and in-between connections 06 From connection to files: what access evidence adds 07 What connection evidence does not prove 08 Source architecture: where else the evidence lives 09 Worked examples 10 Common mistakes and technical limitations 11 Questions to ask · Suggested wording 12 Checklist and red flags · When to involve a digital forensic expert 13 Frequently asked questions 14 Glossary · References · Disclaimer · How a specialist laboratory can assist § 0 1 · ORIENTATION Executive summary THEHEADLINEPOINT : CONNECTIONISPROVABLE ; MEANINGISBUILT § 0 2 · FIRSTPRINCIPLES The problem in plain English: one stick, one afternoon, one question § 0 3 · THERECORDERS The artefact stack: where connection is recorded RECORDER WHAT IT HOLDS, AND ITS ROLE IN THE PROOF § 0 4 · WHICHSTICK Identifying the specific device: serials and volume identity § 0 5 · WHEN Timing: first, last and in-between connections § 0 6 · FROMPRESENCETOCOPYING From connection to files: what access evidence adds § 0 7 · THEEDGES What connection evidence does not prove § 0 8 · THEWIDERMAP Source architecture: where else the evidence lives EVIDENCE EXAMINED PCS THE DEVICE TOOLING (DLP / BACKUPS DELETED / PC (SAME ITSELF DEVICE OF THE PC RECOVERABLE OTHER CORPORATE SERIAL) CONTROL) § 0 9 · INTHEWILD Worked examples EXAMPLE1 · THESERIALTHATCROSSEDTHREEMACHINES EXAMPLE2 · THECONNECTIONTHATWASITALLALONG EXAMPLE3 · THEREFORMATTHATDATEDITSELF § 1 0 · WHEREITGOESWRONG Common mistakes and technical limitations Common mistakes Technical limitations § 1 1 · INTERROGATORIES & DRAFTINGAIDS Questions to ask · Suggested wording Ask your client Ask your opponent Ask your eDiscovery / forensic provider SUGGESTEDWORDING · INSTRUCTIONFORUSBCONNECTIONANA LY SIS § 1 2 · QUICKCONTROL Checklist and red flags · When to involve a digital forensic expert The USB evidence checklist Red flags When to involve a digital forensic expert § 1 3 · COMMONQUESTIONS Frequently asked questions How certain is device identification, really? Can someone delete the connection records? The connection was two years ago. Too late? He says the stick was for personal photos. How is that tested? Do phones connected by cable show up like memory sticks? What single step most strengthens a USB case? § 1 4 · REFERENCE Glossary Sources and authoritative references DISCLAIMER § HOWASPECIALISTLABORATORYCANASSIST Working with Computer Forensics Lab Speak to a forensic examiner, not a salesperson. INSTRUCTTHELAB NEWENQUIRIESEMAILE - DISCOVERY