A client asked me if it was possible to determine if a custodian did copy files from their server to an external USB flash drive. The USB drive isn’t available, so they wanted to know if Microsoft Windows tracks where files are copied.
Now, you would think that with all the information that is tracked and recoverable from computers today that we could surely have the date, time, and location for files that were copied. Unfortunately, Windows doesn’t track information related to the source and destination for any files it copies.
There are, however, a couple other checks we can do to identify if files on a computer have been accessed using external media. I’ll cover how to do that in my next post.