Question 1

We have the stick. Do we still need the computers?

Accepted Answer

For a strong case, yes: the device supplies content and arrival times; the machines supply connection records, sessions and access artefacts: and the welds between them are what attribution stands on. A device alone proves what it holds and roughly when it arrived; paired with even one source machine it proves the corridor the files travelled and whose session the transfer sat inside. Ask for both in the same order wherever possible.

Question 2

The files were deleted from the stick before it was handed over. Gone?

Accepted Answer

Frequently not: removable-media deletion is shallow (index dropped, content resident until overwritten), and sticks see little post-deletion writing in the ordinary course. Expect file-system remnant recovery first (names, dates, content) and carving behind it: unless the device is a TRIM-active SSD, where the honest answer arrives only after imaging. Reformatting changes little: prior volumes and content routinely survive quick formats, and the reformat's own date joins the chronology.

Question 3

Can you tell which computer the files came from?

Accepted Answer

Often, by convergence: source-side modified times and embedded metadata carrying the origin environment; host droppings typing the platforms the device met; and, decisively, the machine-side interlock: the source computer's own records of this device's serial, connected in a session, with the very files accessed in the window the device says they arrived. Any single strand indicates; the convergence identifies: and the report will use exactly those verbs.

Question 4

The device belongs to the company but lived on a shared desk. Is attribution hopeless?

Accepted Answer

No: it is shared-asset work, per Example 3: map the users whose sessions the device appears in across the machine fleet, read the content's internal ownership signals, and time the disputed transfer against the session record. Shared possession widens the starting pool and the interlock narrows it: some time s to one, some time s to two-with-submissions: and a report that shows that narrowing honestly out per form s one that never admitted the pool existed.

Question 5

What about memory cards from cameras, dashcams and phones?

Accepted Answer

Same laboratory treatment, distinct habits: DCIM structures and device-written metadata (camera model, some time s GPS in the images themselves) make provenance unusually rich; FAT semantics govern times; deletion recovery is typically generous; and the card frequently outlives and contradicts the device it served ("the dashcam footage was overwritten" meets the card's unallocated space). Treat cards as first-class exhibits, not accessories: they decide cases about incidents, journeys and timelines with some regularity.

Question 6

Our opponent simply has not produced the drive we know exists. What now?

Accepted Answer

Run the fallback line: machine-side records prove the device's existence, serial, and every connection (guide 47); corporate tooling and server audit prove access and pattern; onward copies are pursued where the content travelled. Then put the absence itself to work: specific disclosure and delivery-up applications, questions about disposal with dates, and the adverse-inference submission that a produced device would have answered. Non- production of a pocketable exhibit is rarely neutral, and courts are readier than opponents expect to say so. cflab. u k · e-disc ove r y. u k ©2026 Computer Forensics Lab Ltd ·cflab.uk ·e-discovery.uk ·info@cflab.uk ·+44 (0)20 7164 6915 Page 15 of 18

External Storage Devices As Evidence