USB and Removable Media Forensics

Every suspected copying case comes down to the same three things: what was plugged in, at what time, and what went across. A Windows machine settles the first two on its own, without ever being configured to, and yields most of the third to somebody who knows where it keeps its notes. The findings are lifted off a verified copy and put in sequence, for employers in Leicester, Loughborough, Hinckley and the estates either side of the M1 and M69.

Authority first. Bench afterwards. The full examination, written up as a report, comes to £800 + VAT. Stop at a verified image with its deleted material extracted and nothing reported, and it is £400 + VAT — the rung a recorder disk already occupies. Diagnosis is free and the scope is agreed in writing beforehand. No fix, no fee all jobs except electronic and mechanical failures, chip level work, DVR and Forensic jobs. Ordinary recovery bands are on the data recovery cost page.

// when a stick is the entire case

What a device register puts beyond argument

No other single object generates as much of this work as a five-pound memory stick does.

A stick nobody recognised, appearing on a desk during a notice period
Serials in the registry that match nothing on the asset register
A leaver arguing that both the device and its contents were personal property
A dashcam, drone or camera card that has become the centre of the case
A portable SSD signed out on a Friday afternoon and never returned
An outright denial that any device was ever connected to the machine

A register nobody asked the machine to keep

Windows writes down every piece of removable hardware it meets, whether or not anyone wants it to. Under the system hive, the USBSTOR key holds a maker, a product and an instance identifier for each stick, reader and portable disk; on devices that report one, that identifier is literally the serial printed on the case. From Windows 8 onwards the properties against each entry also carry the first time it was connected, the last time it was present and the moment it was removed. Driver installation is timed to the second in the setupapi log. Separate keys bind a serial to the letter it took and the volume name it advertised, while the partition diagnostic log notes disks arriving complete with their capacity. Extracted from a copy, all of that amounts to a register spanning the machine's working life, and it routinely lists equipment nobody had mentioned before it appeared in the schedule.

From it was here to it took something

Proving attachment is easy and rarely sufficient. What a case wants is evidence that files travelled. The recent items folder holds shortcut records for documents opened from whatever letter the device took, and each of those records stores a target path, a size and the volume's own serial — the detail that pins a named document to one specific stick instead of to removable media in general. Jump lists repeat the exercise per application and survive the shortcuts being tidied away. Shellbag structures keep the shape of the folders somebody browsed on a device long after that device has disappeared. The change journal puts all of it into minute-by-minute order. And where the stick is actually handed over, imaging it fills in the remainder: what it carries now, when each item landed, and what has since been taken back off.

Reading a copy off the clocks

There is a signature in the timestamps whenever something is duplicated onto another volume, and recognising it is a good deal of the craft. The created value at the destination records the instant of the copy. The modified value does not move: it comes across unchanged with the contents. So a spreadsheet whose creation time is a quarter to eleven on a Sunday night, and whose last modification was over a year before that, is not telling you when it was written. It is telling you when it was taken. Line those up against the device register and the journal and every transfer acquires a date, and a run of them at ten at night in the final fortnight of employment is seldom the coincidence it is put forward as.

Cards, portable SSDs, and two things this cannot do

The pen drive is simply the most frequent visitor. Memory cards out of cameras, dashcams and survey instruments, CompactFlash from older equipment and portable solid state drives all go through the same imaging and the same analysis. Card instructions run in both directions: sometimes to show that company documents reached a card, sometimes to bring back photographs or footage deleted off one. Wherever a card sits at the centre of a matter it is examined alongside whichever computer wrote to it, so that neither account goes untested. Two limits deserve stating rather than being discovered later. Serials identify equipment and never a person. And a device that has been reformatted and refilled yields far less than one returned untouched, which is a reason to ask for it now instead of waiting for disclosure.

The handling standards behind all of this sit at the forensic recovery hub. Putting an hour on a removal belongs to deleted-file forensics, and the employer instruction this normally forms part of is employee data theft. If a stick has merely stopped working and nobody is arguing about anything, none of this applies: that is USB stick recovery at the ordinary band.

// what goes into the schedule

Removable media, one finding at a time

Each line carries a date, the profile it attaches to, and the record it was read out of.

Device inventory

Every stick, reader and portable disk this machine has mounted, with its serial.

Dates of contact

First seen, last seen and last removed, read from the properties of each entry.

Volume binding

Link and jump-list records tying one named document to one specific volume.

Folders explored

Shellbag structures describing directories browsed on media no longer present.

Transfer clocks

The timestamp pattern copying leaves, used to fix the hour of each transfer.

The device itself

The stick or card imaged in its own right, and its deleted contents recovered.

// what it costs, and who is entitled to ask

The fee, and the authority behind the instruction

Two figures, published rather than implied

The least popular sentence first. Forensic work does not sit under no fix, no fee. That guarantee belongs to logical recovery, and the exclusions published beside it are electronic and mechanical failures, chip-level work, DVR jobs and forensic jobs. An examination is bench hours spent answering a question you have asked, and the hours are the same whether the answer helps your case or wrecks it. Against that, two figures are printed here rather than quoted on application, which is two more than most laboratories will commit to in public. Where the examination finishes with a full written report the fee is £800 + VAT. Where it finishes at the evidence — a verified binary image with the deleted material lifted out of it, handed to your solicitor or to another examiner to interpret — the fee is £400 + VAT. That lower figure is the same rung as a recorder disk or a BitLocker volume, so nothing on this page invents a sixth band.

£800 + VAT

The examination plus the written report it produces, set out so that an expert paid to disagree with you can follow every step and try to break it.

£400 + VAT

The verified binary image with its deleted material extracted, and no report written. The rung a recorder disk or an encrypted volume already occupies, not an extra band.

Both assume a single machine and a single question asked of it. Eleven laptops, a file server and a tenancy export is a larger exercise altogether, so anything spanning several devices is measured during the free diagnostic and written down before you are asked to agree to it. Working out what is there costs nothing and still closes 2 working days after the device is booked in at Cambridge, and the fee is settled before an examiner opens the image rather than after the findings are known. Anything that is not forensic keeps the band it has always had on the prices page.

The footing an examination has to stand on

Removable-media work runs on computers and media the business itself owns and issued, or under a solicitor's written instruction. Three routes reach this bench and there has never been a fourth. Kit the business bought and issued to somebody. A written instruction from a solicitor, an insurer or the court. Or a device that genuinely belongs to the person asking, which in a family matter means owned outright or owned jointly. Nothing is broken into here. Somebody else's password is not worked out, monitoring software is not installed on a device the client does not own, and live traffic is never intercepted — interception belongs to the bodies named in the Investigatory Powers Act 2016 and to no private laboratory. Where a client has no lawful right to look inside a device, instructing us does not manufacture one. Handsets and tablets are outside the practice altogether.

// how the media reaches Cambridge

Sending a device — and the three exceptions

A drive and the computer that wrote to it are best examined as a pair, so ring 0800 689 0668 and the set gets agreed before the box is taped shut. Nobody in this network collects and there is no counter in Leicester: items reach Cambridge by tracked, insured post or over the counter there during office hours, and each is entered in the custody record on arrival.

The general rule is the drive travels and the machine stays behind — out of the laptop, out of the tower, out of the iMac, out of the recorder under the counter. This bench does not dismantle equipment, and a repair shop will do it while you wait. Three things are the other way round, and getting them wrong costs you the recovery: an external drive stays sealed in its own case, a NAS comes as a complete unit, and a WD My Passport or My Book travels whole with its cable, because on those the encryption key is held on the bridge board rather than on the disk — separate the two and the data becomes unreadable even to us. A Fusion Mac needs both of its drives, each labelled. The one thing nobody can work round is flash soldered onto the mainboard, as on Apple Silicon machines: if it will not come off, there is nothing to post.

  • A stiff box or a well-padded mailer, with enough packing that nothing moves when you shake it. Power supplies, docks and cables can stay at home unless the drive is one of the WD units above.
  • Running a RAID or a server? Send the member disks on their own, not the chassis or the controller, and write the bay order on each one — 1, 2, 3 and so on. Photograph the front of the unit before you pull anything, because that photograph occasionally saves a day of work.
  • Fill in the shipping and booking-in form (PDF) — a name, a number you actually answer, and a line on how the trouble started — and put it in the box.
  • Special Delivery is tracked and insured and is what most people use; your own courier is equally fine. Handing it over in person also works: reception at the Cambridge address takes devices across the counter, Mon–Fri 9:00am–5:30pm. What does not exist is a Leicester counter or anyone who comes to collect.
// write this on the label

Cambridge Data Recovery

Compass House
Vision Park, Chivers Way
Cambridge, CB24 9AD

↓ Print the shipping & booking-in form (PDF)

Address it to Cambridge Data Recovery. It is about seventy miles from Leicester if you fancy driving it — M1 south to Junction 19, then the A14 east — and the lab is two minutes off Junction 32 with parking at the door. Posting costs you a stamp and a day instead. Whichever you choose, you hear from us the moment it is booked in, and the free diagnostic closes two working days after that.

Not certain what belongs in the box? Ring 0800 689 0668 before you tape it up, or let the free online diagnostic ask the questions for you.

// removable media — before instructing

The questions a serial number raises

Not at all. Almost everything useful — the register, the dates of contact, the volume binding, the transfer clocks — was written by your own computer and is sitting on your own disk. The device would confirm what it actually held, which is worth having but is not the foundation. The report separates the conclusions resting on the machine alone from the ones that would firm up if the drive appeared at disclosure.
In most cases, yes. It establishes the current contents, the timestamps fixing when each item landed, and anything cleared off afterwards — a hurried tidy-up on somebody's last morning is a finding all by itself. It also allows hash comparison against your own originals, which moves the evidence from these look alike to these are the same file.
No. It tells you about a piece of equipment, a user profile and a window of hours. Working out who was sitting there during that window is a job for shift records, door-access data and witnesses, and no registry key will do it. The report marks the point at which technical evidence runs out and inference would have to begin.
Only with their consent, under a protocol the solicitors have agreed, or on a court direction. Property belonging to somebody else is beyond an employer's reach and beyond ours as well. Everything your own machine noted about that drive, though, belongs to you, and in practice that is where most of the account comes from.

A serial number is not an opinion.

Stop using the computer, hold on to anything that came back with it, and ring the freephone before somebody reformats something.