ZEKASTRA

VI-01 · Computer and disk forensics

Files copied to a USB drive before a resignation

A departing employee is suspected of copying a project folder to a USB drive. Agreeing Windows artifacts show the device, the time and what was copied.

Synthetic case for educational use. Organisations, people, numbers and hashes are invented.

01The question

Was a USB mass-storage device connected to the workstation in the employee's last week, and is there evidence that the "Kuzey Makine teklif" folder was copied to it?

02Background

A fictional manufacturer, Kuzey Makine, asks for an examination of a resigning engineer's Windows 10 workstation after a client folder appeared with a competitor. The workstation was imaged nine days after the last working day. There is no allegation about how any file was created; the question is limited to copying to removable media.

03Constraints

  • The USB drive itself was not available; only the workstation image was examined.
  • Security auditing for object access (event 4663) was not enabled, so file-copy events were not logged.

04Evidence received

ItemFormHashNote
Disk image of the workstation (E01, single internal SSD)F-03sha256: 4f1c…a09eSource and image hashes recorded as matching before examination.
Registry hives (SYSTEM, SOFTWARE, NTUSER.DAT for the user)F-04sha256: 9b22…77d1Transaction logs applied for a current view.

05Examination method

  1. Identify the device and its connection times

    USBSTOR and the Windows Portable Devices keys in SYSTEM/SOFTWARE gave the vendor, product and serial of one mass-storage device first seen two days before the last working day. setupapi.dev.log recorded the first install time; the volume's drive letter and GUID were read from MountedDevices. Each value was recorded with its registry path.

    USB device history (USBSTOR, USB, MountedDevices, setupapi.dev.log)Timestamp decoder

  2. Find user activity that references the device volume

    LNK files in Recent and Jump Lists for Explorer carried the target path and the volume serial number of the removable drive. Several LNK targets pointed at files under the drive letter assigned to that volume, inside a folder named for the client. Shellbags showed the folder had been browsed from the removable volume.

    LNK shortcut filesJump ListsShellBags (BagMRU / Bags)Timestamp decoder

  3. Corroborate copying with file-system journals

    On the internal drive, the $MFT and $UsnJrnl showed the source folder's files being read (last-access where enabled) and matching file names appearing in the LNK set. SRUM recorded Explorer's and a file-manager's activity in the relevant hour. Because the USB drive was absent, the copy is inferred from device-side records that reference the external volume, not from the external volume itself.

    $MFT (NTFS Master File Table)$UsnJrnl:$J (USN change journal)SRUM (SRUDB.dat)Timestamp decoderHash calculator

  4. Place the activity on the account and tie it to UTC

    Security log event 4624 type 2 showed the engineer's account interactively logged on across the window in which the LNK and Jump List entries were written. All times were normalised to UTC using the system time zone read from the registry, with the original local value kept alongside.

    Windows XML Event Log (EVTX)Local time to UTCEvent 4624

06Findings

  • Established

    A single USB mass-storage device with a recorded serial was connected to the workstation on three occasions in the final week; the first connection was two days before the last working day.

    BasisUSBSTOR, MountedDevices and setupapi.dev.log agree on the device and times.

  • Established

    The client folder and files inside it were accessed from that removable volume by the engineer's interactively logged-on account.

    BasisLNK and Jump List entries carry the volume serial; Shellbags show browsing; 4624 places the account on session.

  • Probable

    The files were most likely copied to the removable volume rather than only opened from it.

    BasisDevice-side read activity plus the folder structure on the external volume support copying, but the USB drive was not examined.

07Limits

  • Without the USB drive, the lab cannot confirm the bytes written to it or that every listed file arrived complete.
  • Because object-access auditing was off, there is no event-log record of the copy operation itself.
  • The examination does not address whether the engineer was authorised to use removable media; that is a policy question, not a forensic one.

08Report excerpt

The removable volume with serial ****A21F was connected on 2026-… at 07:41 UTC (10:41 local). LNK target \Device\…\E:\Kuzey Makine teklif\fiyat.xlsx carries that volume's serial. The engineer's account (4624 type 2) was logged on throughout. We state copying as probable, not established, because the USB drive was not available for examination.

09Lessons

  • The volume serial number in LNK and Jump List entries is what ties on-disk activity to a specific removable device.
  • Name the missing evidence (the USB drive) and let it lower the confidence rather than writing around it.
  • Auditing settings decide what event-log evidence can exist; record what was off.

10Sources

  1. Microsoft — Audit object access
  2. Microsoft — Shell link (.LNK) binary file format