One of the most common questions in corporate investigations is simple: did someone copy data to a USB stick? Connecting a USB device leaves a series of traces on the computer that, read together, often make it possible to establish which device was connected, when, with which drive letter and, in some cases, which files were opened from it.
Why the system leaves traces
When you plug in a device, the operating system has to recognise it, load the right driver, assign it a name and, if it is a storage medium, mount its volume. Each of these steps is recorded so the system can recognise the device next time. These records, not designed for investigations, form the basis of the analysis.
The information that can be obtained
Device identification
Every USB device reports some identifiers to the system:
- vendor identifier and product identifier, indicating make and model;
- serial number, assigned by the manufacturer, which in many cases distinguishes that specific stick from all others of the same model;
- friendly name of the device.
Not all devices have a unique serial number. Some cheap ones lack one or use a generic one; in that case the system generates its own identifier, which does not allow the stick to be recognised on another computer.
Connection dates
On Windows, device information is spread across the registry, the event logs and the driver installation log file. Combining them usually yields:
- the first time the device was connected;
- the last time it was connected;
- sometimes the last removal;
- in some versions, a history of later connections in the event logs.
Drive letter and volume name
The system records which drive letter, for example E: or F:, was assigned to the volume and what its name was. This is valuable because it links the device to files opened from that letter.
User
Some entries are recorded in the profile of the user logged on at the time of connection. This makes it possible to establish which account opened the volume.
Linking the device to files
Knowing that a stick was connected does not yet say what was done. To get closer to the answer, other artifacts are cross-checked:
- recent file shortcuts: if a file was opened directly from the stick, the shortcut created by the system records the path with the drive letter and often the volume serial number;
- lists of visited folders, which show folders opened on the device;
- program histories, such as a word processor's recent documents;
- timeline: rapid accesses to many files on the computer during the minutes the stick was connected may suggest a copy.
| Question | Main sources |
|---|---|
| Which device? | Vendor, product and serial number identifiers |
| When? | Registry, event logs, driver installation log |
| Which user? | Entries in the user profile |
| Which files were opened from the device? | Recent shortcuts, visited folders |
| Were files copied to the device? | Timeline, analysis of the stick itself |
The main limit: copying does not always leave traces
The system records opening files from a device well, but copying files from the computer to the device much less so. Dragging a folder across may generate no specific entry at all. Indirect evidence, such as the access timeline, consists of clues to be weighed carefully, because antivirus software or indexing can produce similar accesses.
The strongest evidence comes when the stick is also available: analysing its file system can show which files it contains or contained, with dates consistent with those on the computer, and the serial number confirms it is the same device.
Other operating systems and devices
macOS and Linux also record device connections, in system logs with a different structure and often a shorter retention period. Phones connected via USB, external drives and card readers leave similar traces, with some variation in how they are recognised.
Good practice
- Acquire the computer's drive before any check, so as not to add new connections.
- Do not plug the suspect stick into any computer "to see what is on it": use a write blocker.
- Document the serial number and identifiers of every seized device.
- Compare times in a single time zone.
- In the report, clearly distinguish what is proven from what is merely consistent.
In short
- Every USB connection leaves identifiers, dates, drive letters and the user.
- The serial number often makes it possible to recognise the individual stick.
- Opening files from the device is well documented; copying to it much less so.
- Having the stick as well greatly strengthens the conclusions.
- Acquire first, check later, and never connect the device without protection.