USB and Removable Media Forensics

Suspected copying narrows down to three questions. Which device was attached. When it was attached. What went onto it. Windows answers the first two without being asked and gives up most of the third to a careful examiner. Those answers are read off a verified image and set out in order, for employers across Bracknell Forest, the Reading and Slough corridor and the London boroughs.

Footing first, bench afterwards. An investigation with its full written report is £800 + VAT; a verified image with deleted-file extraction and no report written is £400 + VAT, the same point as a recorder disk. The diagnostic is free and the scope goes in writing first. No fix, no fee all jobs except electronic and mechanical failures, chip level work, DVR and Forensic jobs. Ordinary recovery bands are published on the data recovery cost page.

// when a stick is the whole case

What a device register puts beyond argument

More disputes reaching this bench turn on a pen drive than on any other single piece of hardware.

Colleagues remember a pen drive appearing during somebody's notice period
The registry lists serial numbers that no asset record can explain
A leaver maintains both the drive and the files on it were their own
A camera, drone or dashcam card has turned into the whole argument
A portable SSD left the building on a Friday and was never seen again
The flat position is that nothing was ever plugged in at all

Everything the machine has ever met

Windows takes notes on removable hardware whether anyone wants it to or not. The USBSTOR key under the system hive records the manufacturer, the product and the instance identifier of each stick, card reader and portable drive, and for devices that report one that identifier is the serial number printed on the casing. Since Windows 8 each of those entries also carries first-connected, last-connected and last-removed timestamps in its properties. setupapi.dev.log dates the first installation of the driver to the second. Mounted-device and portable-device keys tie a serial to the drive letter and the friendly volume name it appeared under, and the partition diagnostic log records disks being attached with their capacity and serial. Pulled from an image, that is a register covering the machine's whole working life, usually including hardware nobody mentioned until it turned up on the schedule.

Getting from presence to movement

Attachment shows a device was there. A case normally needs to show files moved. Shortcut files in the recent folder record company documents opened from the letter the volume held, and each one keeps the target path, the file size and the volume serial number, which is what matches a document to a particular stick rather than to sticks in general. Jump lists do the same job per application and survive the shortcut being cleared. Shellbags preserve the folder structure somebody browsed on the device long after the device has vanished. The change journal orders everything around it minute by minute. Where the stick itself is produced, its own image completes the picture: what it holds now, when each item landed on it, and what has been taken off since.

What copy timestamps give away

Copying leaves a signature in the clocks, and reading it correctly is half the skill. When a file is copied onto another volume the created time records the moment of the copy while the modified time travels unchanged with the contents. A document created at 22:47 on a Sunday but last modified fourteen months earlier is therefore telling you when it was copied, not when it was written. Set that against the device register and the journal and each transfer gets a date. A cluster of them outside working hours, in the fortnight before a notice period ends, is rarely the innocent explanation it is offered as.

Cards, portable SSDs and the honest limits

Pen drives are only the commonest example. SD and microSD cards out of cameras, dashcams and survey equipment, CF cards from older kit and portable SSDs are all imaged and analysed by the same route. Card instructions run in either direction: documents traced onto a card, or deleted stills and video pulled back off one. Where a card is central to the matter it is examined next to whichever computer wrote to it, so that neither version of events goes unchecked. Two limits deserve saying out loud. A serial number identifies hardware and never a human being. And a drive that has been reformatted and filled with something else gives up far less than one handed straight back, which is a reason to ask for it sooner rather than at disclosure.

Method and custody are described at the forensic recovery hub. Dating a removal continues at deleted-file forensics, and the employer casework this feeds is at employee data theft. Where a stick has simply failed and nobody is in dispute, that is ordinary USB recovery at the band on the prices page.

// what goes in the schedule

Removable media, finding by finding

Each entry names its date, the profile it belongs to, and the artefact it was taken from.

Hardware register

Maker, product and serial for every device the computer has ever mounted.

Connection history

When each one first appeared, when it was last present, when it was pulled.

Opened-from proof

Shortcuts and jump lists binding named files to one named volume, not to any volume.

Browsing residue

Shellbag entries showing which directories were explored on the device itself.

Copy signatures

The clock pattern a copy leaves, used to date each transfer onto the media.

The media itself

The stick or card imaged in its own right, deleted contents brought back.

// paying for it, and being entitled to ask

What it costs, and who may instruct

Two figures, printed rather than hinted at

Start with the part people are least often told: a forensic examination sits outside no fix, no fee. That guarantee belongs to logical recovery work, and the stated exclusions are electronic and mechanical failures, chip-level work, DVR jobs and forensic jobs. An examination is bench time spent answering a question, so it is charged whether the answer helps you or not. What it does have is two published figures, which is two more than most laboratories will put in front of you. An examination that ends in a full written report is £800 + VAT. An examination that stops at the evidence itself — a verified binary image with the deleted material extracted out of it, handed over for somebody else to interpret — is £400 + VAT. That second figure is the same point on the list as a recorder disk or a BitLocker volume, so it adds nothing new to the five bands the rest of the site publishes.

£800 + VAT

The examination and the full written report that comes out of it, produced so an expert acting against you can follow every step and test it.

£400 + VAT

The verified binary image with deleted files extracted from it, and no report written. The same figure a recorder disk or an encrypted volume carries, not an extra band.

Both figures assume one machine and one question put to it. Nine laptops, a file server and a tenancy export is a larger exercise, so anything spanning several devices is measured after the free diagnostic and written down before you agree to it. Diagnosis still costs nothing and still closes 2 working days after the device is booked in, and the fee is settled before an examiner opens the image rather than after. Everything that is not forensic keeps its published band on the prices page.

The footing an examination needs

This work is done on company computers and on media the company issued, or on written instruction from a solicitor. Three routes reach this bench and there has never been a fourth. Equipment the business itself bought and issued. A written instruction from a solicitor, an insurer or the court. Or a device that genuinely belongs to the person asking, which in a family matter means one owned outright or owned jointly. Nothing is broken into here. We do not work out somebody else's password, we do not put monitoring software on a device the client does not own, and live traffic is never intercepted — interception belongs to the bodies named in the Investigatory Powers Act 2016 and to nobody else. Where a client has no lawful right to look inside a device, instructing us does not create one. Handsets and tablets fall outside the practice altogether.

// getting the media to the bench

Booking a device in — what actually has to happen

A drive and the computer that wrote to it are best looked at as a pair, so ring 0800 689 0668 and we will agree the set before the box is taped up. There is no collection anywhere in this network and no counter in Bracknell: items reach Guildford by tracked, insured post or over the counter there in office hours, and each is entered in the custody record on arrival.

Is the storage still bolted into a machine — laptop, tower, iMac, MacBook, rack server, a DVR under the till? Free it first and send the bare unit. Stripping hardware is not something this lab does, though it is ten minutes' work for any repair shop on your high street. There is a single case with no way round it: memory chips soldered flat onto the mainboard, which is how Apple Silicon machines and certain ultrabooks are built. Where the storage cannot be unbolted, there is no parcel to make up.

  • Pick packaging that holds its shape — a rigid carton or a heavy padded mailer — and pack round the unit so it cannot shift in transit. Leave the caddy, the mains adaptor and the leads at home; none of them are wanted at this end.
  • Print the shipping and booking-in form (PDF), put your name and mobile on it along with a sentence describing how the fault started, and slip it in alongside the media.
  • Send it Special Delivery through the Post Office and it travels tracked and covered. A courier account of your own works just as well. The only thing that matters is that somebody signs for it at this end.
  • If you would sooner deliver it by hand, the Guildford reception on the address card takes devices over the counter, Mon–Fri 9:00am–5:30pm. Neither a Bracknell shopfront nor a pickup van exists — those are the two things we cannot offer.
// write this on the label

Guildford Data Recovery

Building 2, Ground Floor
Guildford Business Park
Guildford, GU2 8XH

↓ Print the shipping & booking-in form (PDF)

The name on the parcel wants to be Guildford Data Recovery. Driving it over from Bracknell is roughly forty minutes on the A322 then the A3; posting it costs you a stamp and a day. Either way, a message goes out to you as soon as it is logged onto the system, and two working days later the diagnostic is finished.

Unsure whether something should go in the box? Ring 0800 689 0668 while the lid is still open, or work through the free online diagnostic and let it tell you.

// removable media — before instructing

The questions a serial number raises

Far from it. The register, the plug-in times, the opened-from evidence and the copy signatures all live on the computer rather than on the missing device, so the account can be built without it. What the stick itself would add is confirmation of contents. The report is clear about which conclusions stand on the machine alone and which would harden if the drive were produced at disclosure.
Usually. It shows what is on the device today, the timestamps that date the copying, and whatever was cleared off it afterwards — a tidy-up on the last morning is a common finding in its own right. It also allows the contents to be hash-matched against your originals, which turns a resemblance into an identity nobody can argue with.
It identifies hardware, a user profile and a set of hours. Putting a named individual at that desk during those hours is the wider case's problem, and it is solved with rotas, door-access records and witness statements rather than with registry keys. The report says where the technical evidence stops and inference would have to take over.
Not unless they agree, the solicitors settle a protocol, or the court directs it. Somebody else's property is outside an employer's reach and outside ours. What your own computer recorded about that drive is yours, and in practice it tends to carry most of the account anyway.

A serial number is not an opinion.

Leave the computer alone, keep hold of the drive, and ring the freephone before anybody reformats anything.