Were files copied to external device? (USB Flash Drive)


In my last post, I mentioned there are a couple of ways to identify if files have been stored on an external device. Here they are:

1) Examine the file access history - To be thorough, you need to look at two different user activity areas. 1) User activity logs currently available through Windows and 2) Recovered deleted or purged activity logs. In these logs you can see the files a user opened. If the user opened suspect files from an external device and those files match the names of files from a source computer, the files may be the same. You may also see *.lnk (shortcut) files that have been linked to an external device.

2) Last 10 Authors and Locations - Microsoft Windows 2003 Word documents track what we refer to as ‘Last 10 Authors and Locations’. This information can be invaluable when trying to identify additional computers or locations where the files may be stored. For a more in -depth discussion you can review my article.

LOADING PDF: If there are any problems, click here to download the file.

DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© Pinpoint Labs | Attorney Advertising

Written by:


Pinpoint Labs on:

Popular Topics
Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:

Sign up to create your digest using LinkedIn*

*By using the service, you signify your acceptance of JD Supra's Privacy Policy.

Already signed up? Log in here

*With LinkedIn, you don't need to create a separate login to manage your free JD Supra account, and we can make suggestions based on your needs and interests. We will not post anything on LinkedIn in your name. Or, sign up using your email address.