USB Drive Handled Before Forensic Submission
A cleaning contractor finds a USB flash drive in a conference room and gives it to the facility security officer. The officer plugs it into his Windows workstation to identify the owner, opens a folder named Finance, then logs out and places the drive in an envelope. Two days later, the drive reaches you with a handwritten note: found Tuesday, opened by R. Patel. The envelope has no tamper seal and no time recorded. The drive is suspected to contain a spreadsheet copied from a restricted HR share. HR wants a report by Friday; legal counsel asks whether the drive can be used in a disciplinary hearing. You have a write blocker, a validated imaging workstation, and a hash tool. The original drive is 64 GB and contains 12 GB of files. The security officer's workstation is managed but not forensically imaged.
1. How should you assess the chain-of-custody and evidence-integrity problems?
Read the worked answer
The chain is broken at several points: no seal, no time of finding or transfer, and the officer accessed the drive on a non-forensic workstation without a write blocker before submission. That does not automatically make the drive unusable, but it weakens authentication and provenance. You cannot claim the current contents are unchanged from the moment of finding because no hash was taken then. Assess what the officer's actions could have altered: last-access timestamps, USB registry artifacts on his workstation, shellbags or jump lists, possibly file contents if he opened anything. Document the gap plainly and avoid overstating integrity. For a disciplinary hearing, the standard may be lower than a criminal court, but the same honesty about handling is required.
2. What steps should you take now to image and preserve the drive and the officer's workstation evidence?
Read the worked answer
Photograph the envelope and drive as received, record identifiers, and create a new tamper-evident package with a documented chain-of-custody form. Image the drive through the write blocker, hash before and after acquisition, verify the image hash, and work only from the copy. Preserve the original. Separately preserve relevant logs from the officer's managed workstation: USBSTOR and mounted-device registry keys, event logs, shellbags, jump lists, antivirus scans, and any file-access auditing. Interview the officer only to document actions, not to fill gaps in the record. The reasoning is to capture both the item and the surrounding artifacts that show what handling occurred, while preventing further alteration.
3. How should the final report describe the evidentiary weight of the USB contents?
Read the worked answer
Use qualified language. State that the drive was found and handled before controlled acquisition, that no pre-access hash exists, and that the officer opened a Finance folder on a managed but non-forensic system. Then state what the acquired image shows, such as file names, hashes, and metadata, without claiming an unbroken chain from the conference room. If the spreadsheet hash matches the HR share copy, that supports copying or possession but does not by itself prove who placed it there or when. Recommend corroboration through HR share access logs, DLP alerts, email records, and the officer's workstation artifacts. The report should give legal counsel the limitations needed to judge admissibility and weight rather than assert a conclusion the handling cannot support.