Following the USB: an insider data theft case
A company suspects an employee walked out with confidential files. I had a disk image, a USB image and a deadline. This is how I worked it, with the answers blurred.
The brief
The scenario: sensitive documents appeared outside a small company. One workstation and one removable drive were seized. The job was to find out whether the data left through that drive, who did it and when, and to keep every step defensible.
Rule one: never work on the original. Hash it, image it, verify the hash, then work only on the copy.
1. Preserve and verify
I acquired both images and recorded their hashes before opening anything. Every later finding refers back to those values, so if anyone asks "was the evidence changed?" the answer is a simple comparison.
# acquisition log (values blurred) workstation.E01 SHA-256 3f9a…c1e07b42d9 verified usb.dd SHA-256 a71c…09fe5d3b88 verified
2. Build the timeline
Before looking for "the file", I built a timeline of the workstation: user logons, device connections, file access and deletions. A timeline turns a pile of artefacts into a story you can test.
- USB device history showed a removable drive connected on a weekday evening.
- Recent-file records showed documents opened from that drive letter shortly after.
- The same user account was active across the whole window.
3. Look where people hide things
The obvious folders were clean. The interesting material was where it shouldn't be: a file whose extension didn't match its header, and an archive that had been deleted but not overwritten.
- Checking file signatures (magic bytes) against extensions exposed a renamed file.
- Carving unallocated space recovered the deleted archive.
- Its contents matched the leaked documents: filename_redacted.xlsx.
4. Link it to a person, carefully
Evidence on a disk shows an account did something, not a person. I tied the activity to the account, the device serial and the timeline, and stated clearly what the evidence could and could not prove.
5. Report it
The report followed the evidence order: acquisition, method, findings, limitations. Every claim pointed to an artefact and a hash, following NIST SP 800-86 and ISO/IEC 27037 practice.
Verdict: data left via the removable drive. The full answer stays in the report.
What I took away
- Timelines first, conclusions later.
- Deleted is not gone. Check unallocated space and file signatures.
- Write down the limits of your evidence. It makes the rest of the report stronger.