When an organisation suspects an outgoing or former staff member of exfiltrating sensitive intellectual property, client databases, or commercial records, removable media is often the primary vector. The short answer to whether file copying can be detected is yes: modern operating systems maintain detailed internal ledgers of hardware attachments, volume mountings, and file access events. Even when an employee attempts to clear their activity, lower-level system artifacts remain intact.
Conducting employee usb forensics does not rely on a single file or log entry. Instead, digital forensic practitioners correlate multiple independent system artifacts to reconstruct a timeline of user activity, establishing precisely which hardware was attached, when it was connected, and which files were accessed or transferred.
Key Operating System Artifacts Created Upon USB Connection
When a USB flash drive or external hard drive is plugged into a Windows machine, the operating system performs a series of background setup tasks. These interactions leave persistent registry entries and log records that survive system restarts and standard user clean-up routines.
1. Windows Registry Traces (USBSTOR and MountedDevices)
The Windows Registry acts as a central database for configuration and device history. Two primary keys provide foundational evidence during an investigation:
- SYSTEM\CurrentControlSet\Enum\USBSTOR: This key records the vendor, product name, firmware revision, and unique serial number of every USB mass storage device ever connected to the machine. If the manufacturer does not assign a unique hardware serial number, Windows assigns one containing an ampersand (&) in the second character position.
- SYSTEM\MountedDevices: This key maps the unique device identifier or volume GUID to the drive letter assigned by Windows (for instance, E: or F:) at the time of connection.
2. Device Setup Logs (SetupAPI)
In Windows, the setupapi.dev.log (or setupapi.offline.log) records device installation events. It documents the exact timestamp when a specific USB device was first plugged into the computer, as well as subsequent driver installations. Cross-referencing these entries against system event logs helps establish first and last connection times with high precision.
3. Event Logs
Depending on the operating system configuration, specific Windows Event Logs record hardware activity:
- Microsoft-Windows-Partition/Diagnostic: Logs Event ID 1006 when a removable volume is attached, recording its capacity, manufacturer details, and volume serial number.
- DriverFrameworks-UserMode: If enabled, Event IDs 20001 and 20002 log the arrival and removal of user-mode driver interfaces associated with USB devices.
- Storage-ClassPnP: Event ID 5079 highlights external device connection events across modern builds of Windows.
Proving File Access and Exfiltration
Establishing that a USB drive was connected to a laptop or workstation is only the first phase of an exfiltration investigation. The critical second phase involves demonstrating that specific company files were actually accessed, moved, or copied to that external drive.
Shortcut (LNK) Files
When a user opens a file stored on an external USB drive—or opens a local file and saves a copy directly to an external volume—Windows automatically creates a shortcut (LNK) file in the user's Recent items profile folder. LNK files contain rich metadata, including:
- The original volume name and drive letter of the target file.
- The volume serial number of the storage medium.
- The full path of the accessed file (e.g.,
E:\Client_Data\2024_Financials.xlsx). - Timestamps indicating when the target file was created, modified, and accessed on the external media.
- The MAC address of the network interface card present on the computer at the time of file access.
If an LNK file points to an external drive letter (such as E:\) and contains a volume serial number matching a known USB stick, this provides clear evidence that the file existed on, and was opened from, that specific drive.
Shellbags
Shellbags are registry keys designed to retain user preferences for folder viewing within Windows Explorer (such as icon layout, grid position, and sorting preference). Crucially, Windows creates Shellbag entries whenever a user navigates through directories using Windows Explorer, including folders located on removable drives.
Forensic examination of Shellbag entries can reveal the exact directory structure of an attached USB stick (e.g., E:\Stolen_IP\Schematics\), proving that the user actively browsed those external directories even if the physical USB device has been destroyed or removed from the premises.
The Master File Table and USN Journal
The NTFS file system maintains an Update Sequence Number (USN) Change Journal ($UsnJrnl) and a Master File Table ($MFT). The USN Journal records changes made to files and directories on the local drive. When large volumes of data are selected and copied to an external volume, specific file system flags, allocation changes, and temporary cache files are generated on the host machine.
For deeper insight into how digital evidence is handled under legal scrutiny, consult our digital forensic evidence guide.
Overview of USB Forensic Artifacts
The table below outlines the core digital artifacts examined during an exfiltration investigation, detailing their location and the specific factual questions they address.
| Forensic Artifact | System Location | Primary Information Revealed | Evidentiary Value |
|---|---|---|---|
| USBSTOR Registry Key | SYSTEM\CurrentControlSet\Enum\USBSTOR | Device make, model, and serial number | Proves a specific hardware device was plugged in |
| MountedDevices Key | SYSTEM\MountedDevices | Drive letter mapping and Volume GUID | Links physical device serials to logical drive letters |
| SetupAPI Logs | C:\Windows\INF\setupapi.dev.log | First connection timestamp and driver installation | Establishes the earliest possible connection window |
| LNK Files | AppData\Roaming\Microsoft\Windows\Recent | Path, volume serial, and file access timestamps | Demonstrates file access on or save to external drive |
| Shellbags | USRCLASS.DAT (User Profile Registry) | Folder structures browsed on target drive | Proves manual navigation of external folders |
| USN Journal | $Extend\$UsnJrnl:$J | File state changes and creation events | Tracks bulk file read, move, or creation activity |
Technical Limitations and Challenges
While digital forensics provides robust insight into system activity, legal teams and corporate investigators must understand the technical boundaries of what can and cannot be proven from host machine artifacts alone.
Default Logging vs. Direct Copy Auditing
By default, standard installations of Microsoft Windows do not maintain a direct log entry that explicitly states: "User A copied File X to USB Drive Y at 14:02." Native Windows event logging tracks system events, driver loads, and authentication, but does not enable granular Object Access Auditing unless configured in advance via Group Policy.
Consequently, forensic practitioners establish file copying by building a circumstantial matrix of overlapping artifacts. When an analyst identifies a USB device connected at 14:00, an LNK file showing E:\Confidential\List.pdf generated at 14:01, and Shellbag entries showing active folder creation on drive E:\ at 14:02, the inference of intentional file exfiltration becomes overwhelming and legally defensible.
Impact of Anti-Forensic Software
Employees seeking to conceal data theft may employ privacy cleaners, registry wipers, or specialized software designed to wipe USB connection histories. However, these tools frequently fail to clean all operating system locations. For instance, a software utility might clear the Recent folder shortcuts while leaving intact registry entries in MountedDevices, entries within unallocated space, or shadow volume copies created by system restore points.
In cases where endpoints or secondary mobile devices are involved, investigators may also need to examine mobile phone forensics or cloud storage interfaces to determine if data was staged before being written to physical media.
Ensuring Admissibility in UK Legal Proceedings
For evidence of data exfiltration to hold weight in legal proceedings—whether for internal disciplinary hearings, High Court injunctions, or criminal reporting—the investigation must strictly follow recognized procedural standards.
In the UK, forensic analysis must align with the National Police Chiefs' Council (NPCC) Good Practice Guide for Digital Evidence and Civil Procedure Rules (CPR) Part 35 regarding expert evidence. Key requirements include:
- Preservation and Imaging: The target laptop or workstation must be physically isolated from networks and imaged using write-blocking hardware to create a bit-stream physical copy. Live analysis directly on an active system risks overwriting volatile artifacts.
- Chain of Custody: Continuity of evidence must be documented meticulously from the moment the device is secured until forensic reporting is completed.
- Reproducibility: Forensic methodologies applied by the expert analyst must be verifiable, allowing an independent forensic expert retained by opposing counsel to examine the image and reach identical technical conclusions.
What This Means for Your Case: Practical Next Steps
If your organisation suspects that an employee has copied proprietary files to an unauthorized USB device, taking immediate and structured steps is critical to preserving key evidence:
- Isolate the Computer Immediately: Power down or disconnect the machine from the local network and internet to prevent remote wiping commands, automated system updates, or log rollovers. Do not allow internal IT staff to log in or run administrative utilities, as this overwrites volatile log entries and alters file system access times.
- Secure Physical Media: If any USB storage devices, external hard drives, or personal hardware were left behind by the employee, secure them in static-shielding bags and document their serial numbers.
- Commission a Independent Forensic Examination: Retain qualified digital forensic specialists to perform a bit-stream physical image of the host machine. An expert report compliant with CPR Part 35 can support application for delivery-up orders, search injunctions, or formal employment tribunal proceedings.
- Review Broader Exfiltration Vectors: While USB drives are common, exfiltration often involves secondary vectors. Consider reviewing corporate cloud forensics logs, email gateway records, and web browser download histories to determine if data was transferred off-site prior to USB attachment.
To discuss a specific matter or request formal assistance from our technical team, contact our laboratory directly through our secure inquiry portal.