User Denies Connecting a USB Drive
A Windows 10 22H2 desktop is seized from a finance employee suspected of copying client data. The employee states he 'never plugged any USB stick into that machine; IT must have.' You find a USBSTOR key under CurrentControlSet\Enum\USBSTOR for a Kingston DataTraveler with serial 0019E06B... and a first-install timestamp of 2024-03-11 09:14:22Z. The machine was in daily use until seizure on 2024-06-02. There is no EDR, no Sysmon, and no central logging. The user's profile shows a mapped network drive and OneDrive. The prosecutor wants to charge unauthorized exfiltration and asks you to place the device on the machine at a specific time and to show a file was copied. Corporate policy permits USB storage but requires approval, which was not sought.
1. Identify the artifacts that can corroborate or refute the user's claim, what each actually proves, and its limitations.
Read the worked answer
Separate the claim into three propositions: the device was installed, it was connected at particular times, and a file was copied.
Installation and connection
- USBSTOR key: proves a device with that serial was installed and gives first-install data. It does not prove every later connection.
- Device property timestamps in the registry (install, first-arrival, last-arrival style properties) can indicate last connection, but must be validated against the OS version and interpreted cautiously.
- setupapi.dev.log: records device installation with timestamps; may be truncated by cleaners.
- Event logs: Microsoft-Windows-DriverFrameworks-UserMode/Operational events 2003/2004 and 2100/2102, Kernel-PnP, and Partition/Diagnostic 1006 can show connection and disconnection windows, subject to log rollover.
User activity
- MountPoints2 in the user hive: drive letter assignment and first use by that user.
- Shellbags: folder navigation on the removable volume, proving the user opened folders on it.
- LNK files, JumpLists, RecentDocs, Office MRUs: references to paths on the drive.
- Thumbcache: images viewed from the drive.
- Prefetch: if an executable ran from the drive, the volume path appears; Amcache/ShimCache may corroborate execution.
- SRUM: per-application resource usage, retention typically 30-60 days, so likely covers only part of the period.
Limitations: timestamps can be modified; installation is not connection; logs roll and can be cleared; SRUM retention is short; absence of an artifact is not proof of no activity. State confidence explicitly for each proposition.
2. Can you place the device on the machine at a specific time and show that a file was copied? Explain what you can and cannot conclude and what additional evidence you would request.
Read the worked answer
Probably you can establish installation and a plausible connection window, but not a specific copy without more evidence.
What the current data supports: first installation on 2024-03-11 at 09:14:22Z. If the driver-framework event log survives from March to June, you may be able to show one or more connection intervals and a last-arrival time. If the log has rolled, you can say only that the device was installed by that date and that user-level artifacts reference it.
What it does not support: a specific file copy. Copying a file to removable media may leave only weak traces on the source: an update to last-access time (often disabled), a Shellbag or LNK entry showing the folder was opened, and an entry in $UsnJrnl for file operations on the source volume, but not the destination. The destination file's timestamps live on the USB device, which you do not have.
Requests:
- The Kingston device itself, for examination of file system timestamps and $UsnJrnl on that volume.
- IT approval records and badge/access logs for the relevant dates.
- Volume Shadow Copies and any backup of the workstation.
- Mail, OneDrive, and mapped-drive server logs to see whether the same data left by another channel.
- The user's other devices.
Phrase conclusions as "consistent with connection and folder access on or about X," not "the user copied file Y on date Z." Overstating here is the easiest way to lose the case.
3. What would change if the user had administrator rights and ran a cleaner on 2024-05-30? How would you address that in testimony?
Read the worked answer
A cleaner changes what is available but does not erase everything, and selective deletion is itself evidence.
Look for the cleaner: Prefetch entries for the cleaner executable, Amcache and SRUM records, event log 104 (System log cleared), $UsnJrnl records of file deletions, MFT records for deleted log or prefetch files, and Volume Shadow Copies predating the run. Compare artifact completeness against a control Windows 10 machine; a machine missing exactly the artifacts a cleaner targets is different from one that never had them.
What likely survives: USBSTOR is in the SYSTEM hive and may survive unless the cleaner specifically removed it; setupapi.dev.log may be truncated but not necessarily fully; user hives may retain MountPoints2 or Shellbags. Event logs and prefetch are more likely to be affected.
Testimony approach:
- Keep the three propositions separate: installed, connected, copied. The cleaner affects the second and third more than the first.
- Do not claim wiping proves guilt; state what is missing, what normally would be present, and that the absence limits your conclusions.
- If the cleaner ran after the relevant period, note that it may have removed evidence of the connection while leaving the installation record intact.
- Present the pre-cleaner shadow copy or backup if available as the stronger source.
This is a judgement call: the correct answer is not "he wiped it, therefore guilty," but "the record is partially degraded, here is the boundary of what it proves."