Most departed-employee investigations focus on cloud uploads, email forwarding, and bulk file copies. The USB channel is often under-investigated — partly because USB activity feels old-fashioned, partly because the artifacts require specialist knowledge to interpret.
Five forensic indicators that consistently produce evidentiary results:
1. USBSTOR registry artifacts. Every USB device that has been connected to a Windows endpoint leaves a registry footprint identifying the device, serial number, vendor, and first/last connection timestamps. Months of USB history can be reconstructed.
2. Setupapi.dev.log entries. Windows logs every USB-device installation with a timestamp. Provides a chronological history of devices connected, even if the registry has been cleaned.
3. LNK file artifacts. Files accessed from USB drives leave LNK (shortcut) artifacts in the user's profile, identifying source paths, file sizes, and access times.
4. ShellBags. Folder-browsing history on USB devices is preserved in the user's shellbags, revealing what was looked at — even if the user copied nothing.
5. Volume Shadow Copy snapshots. Historical USB activity can be recovered from VSS snapshots even after the user has tried to clean the registry.
For counsel: USB activity is not a legacy concern. It remains a primary exfiltration channel for employees who don't trust the cloud channel they know their company monitors.