USB Device Forensics and the Register Windows Keeps

Three questions decide a copying case. What was plugged in? At what hour? And did anything go across? A Windows machine answers the first two by itself, having never been configured to do any such thing, and hands over most of the third to anybody who knows where it keeps its notes. All of it is read from a verified copy and set out as a dated sequence — and none of it depends on the device ever coming back, which is the part clients rarely believe until it is shown to them.

A serial number is evidence. It is not a person. £800 + VAT for the examination and its report, £400 + VAT for verified images with deleted contents extracted and nothing written. Same price point as a recorder drive. Free diagnostic, written scope. Forensic jobs sit outside no fix, no fee. A dead stick is £250 + VAT.

A register the machine keeps whether or not you want one

Removable hardware announces itself to Windows and Windows writes it down. In the system hive one key carries a maker, a product and an instance identifier for every stick, card reader and portable disk that has ever been mounted, and where the device reports one, that identifier is the serial printed on the casing. From Windows 8 onwards the properties held against each of those entries have also carried three times: first seen, last present, last removed. Driver installation is timed separately, to the second, in a log of its own. Further keys tie a serial to the drive letter the device took and to the volume label it advertised. Extracted from an image, all of that becomes an inventory covering the working life of the computer, and it regularly names equipment nobody in the business had thought to mention.

From it was plugged in to it carried this document

Attachment is the easy half and on its own it settles nothing. The case needs documents shown to have travelled. Shortcut records in the recent items folder get written when a file is opened, and each holds a target path, a size, and the serial of the volume the file came off — which is the detail that ties one named document to one particular stick rather than to removable media as a category. Jump lists hold the same information application by application and outlive the shortcuts being cleared away. Shellbags retain the shape of directories somebody browsed on a device that vanished months ago. The change journal then puts the lot into minute-by-minute order, which is what turns a pile of individually deniable fragments into a sequence.

Copying leaves its signature in the clocks

Reading that signature is a fair proportion of the craft. Duplicate a file onto another volume and the copy is created at the destination in that instant, so its creation time is really a record of the transfer. Modification time behaves quite differently, belonging to the contents and crossing over untouched. What that produces is a document created at a quarter to eleven on a Sunday evening and last edited fourteen months earlier — a combination that is not describing when anything was written but when it was taken. Put beside the device register and the journal, each transfer acquires an hour, and a run of them late at night across a final fortnight is seldom the coincidence it gets offered as.

What changes when the stick is actually produced

Where the device does come back, imaging it completes the account: what it holds today, when each item arrived on it, and what has been taken off since. A hurried clear-out on somebody's last morning is a finding in its own right and comes with a time attached. Producing the device also permits hash comparison against your originals, which is the step that moves the evidence from these two files look similar to these two files are identical, byte for byte. Where the stick belongs to somebody else it is examined only with their agreement, under a protocol the solicitors have settled, or on a direction of the court — although everything your own computer recorded about that stick belongs to you regardless, and in practice supplies most of the account.

Cards and portable drives, and two limits worth saying early

A pen drive is simply the most frequent visitor rather than the only one. Camera, dashcam and survey cards, CompactFlash out of older equipment and portable solid-state drives all take the same acquisition and the same analysis. Card work runs in both directions, too: as often to recover footage or photographs somebody deleted as to show that company material reached the card in the first place. Then two limits, better heard now than found out later. A serial identifies equipment, never a person. And a device that has been reformatted and filled up again yields a fraction of what an untouched one does, which is an argument for asking for it early instead of waiting for disclosure to produce it.

The handling standards behind all of this are on the forensic practice hub. Putting an hour on the removal itself belongs to deleted-file forensics, and the employer instruction this usually forms part of is employee data theft. Where a stick has simply stopped working and nobody is arguing about anything, none of this applies and USB stick recovery at £250 + VAT is the job you want.

// when a five-pound stick is the case

What a device register puts beyond argument

No single object generates more of this work than a memory stick somebody bought at a service station.

A stick on a desk during a notice period that nobody recognises
Registry serials matching nothing anywhere on the asset register
A leaver insisting both the device and everything on it were personal
A dashcam, drone or survey card that has ended up at the centre of the matter
A portable SSD signed out on a Friday afternoon and never seen again
A flat denial that anything was ever connected to that computer
// what goes into the schedule

Removable media, one dated line at a time

Each line arrives with a date, the profile it belongs to and the record it came out of, so any one of them can be gone back to and checked on its own.

Device inventory

Each stick, reader and portable disk the computer has ever mounted, serials included.

Hours of contact

First seen, last present and last removed, taken from the properties of each entry.

Volume binding

Shortcut and jump-list entries fastening a named document to one particular volume.

Folders explored

Shellbags holding the shape of directories browsed on media that has since gone.

Transfer clocks

The clock pattern a copy leaves behind, used to put an hour on each transfer.

The device itself

Where the stick or card is produced: imaged in its own right, deletions recovered.

// the fee, and who may lawfully ask for it

What it costs, and the authority it stands on

One instruction, two prices, no application form

A stick and the computer it was plugged into are normally one instruction rather than two, and the figure covers the pair of them. £800 + VAT is the whole thing written up: the device register, the hours of contact, the documents bound to a named volume, the copy clocks, set out in a report an opponent can pick apart. £400 + VAT stops one step earlier, at verified images with their deleted contents extracted, for somebody else to read. That second figure matches what a CCTV recorder disk or an encrypted volume costs, so nothing sixth has been added to the band list to accommodate this work.

£800 + VATRegistry, shortcuts, jump lists, shellbags and journal, read together and reported as one dated sequence with each finding attributed.
£400 + VATMachine and device imaged, verified, deleted contents recovered, handed over unanalysed at the recorder-drive price point.

No fix, no fee does not reach this work. It covers logical recovery, and forensic jobs are one of the four exclusions published beside it, with electronic and mechanical failure, chip-level work and DVR jobs. That is why the fee is agreed before an examiner opens anything — a serial number that turns out to be the office printer took the same hours to find as one that turns out to be a stick bought on the M6. Both figures cover one machine and one question; extra devices are counted during the free diagnostic and quoted in writing. That diagnostic is free and closes two working days after booking in at Oxford. A dead stick nobody is arguing about is £250 + VAT and none of this applies.

The device is one question. Authority is another

Removable-media work runs on computers and media a business owns and issued, on a solicitor's, insurer's or court's written instruction, or on hardware that genuinely belongs to the person asking — which in a family matter includes something owned between the two of you. A stick that belongs to somebody else is examined only with their agreement, under a protocol the solicitors have settled, or on a direction of the court; everything your own computer recorded about that stick is yours regardless. The refusals are fixed. No working out or defeating of anybody else's password. No monitoring software supplied, fitted or advised on. No interception of live traffic, which the Investigatory Powers Act 2016 reserves to bodies no private laboratory belongs to. No phones and no tablets, in any case at all.

// removable media — before instructing

The questions a serial number raises

It does not, and this is the misunderstanding that stops people ringing. Nearly everything of value in one of these cases was written by your own computer and is sitting on your own disk — the register, the hours of contact, the binding between a named document and a volume serial, the copy clocks. Producing the device would confirm what it was actually holding on the day, which is worth having and is not the foundation. The report separates the findings that stand on your machine alone from the ones that would firm up if the drive turned up at disclosure.
Usually. It establishes what is on the device now, the timestamps showing when each item arrived, and anything cleared off it since. It also permits hash comparison against your originals, which is the difference between arguing that two files resemble one another and demonstrating that they are the same file. A card or a stick is imaged to the same standard as a hard disk, behind the same write-blocker, and it is normally cheaper to do both at once than to come back for the second one later.
It does not, and a report that implies otherwise will not survive the first serious cross-examination. A serial identifies equipment. Alongside it you get a user profile and a window of hours. Working out who was actually sitting at the keyboard inside that window is a matter for rotas, door-access records and witness statements, and no registry key substitutes for any of them. The report marks exactly where the technical evidence stops and somebody would have to start inferring.
Only where they agree to it, where the solicitors have settled a protocol, or where the court has directed it. Somebody else's property sits outside an employer's reach and outside ours as well. The observations your own machine made about that drive are a different matter entirely: those are yours, and in practice they carry most of the account.
Often, because the two leave different marks. Opening a document from removable media writes a shortcut record carrying the volume serial. Copying it onto the media leaves the creation-time pattern described above, at the destination rather than the source. Where both appear for the same document the sequence is usually clear, and where only one appears the report says which and does not stretch it further than it goes.
// getting your media to Oxford

Posting a device in — what goes in the box

A device and the computer that wrote to it are worth examining as a pair, so call 0800 689 0668 and the set can be agreed before the box is taped up. No collection service exists anywhere in this network and there is no counter in Coventry: parcels reach Oxford tracked and insured, or come across the counter there in office hours, and each item joins the custody record on arrival.

As a rule the storage comes out and the machine stays where it is. That applies to a laptop, a tower, an iMac and to the recorder sitting under a counter. Taking equipment apart is not something this bench does, and a repair shop will free a drive in a few minutes. Two things go the other way: an external drive stays sealed inside its own case, and a NAS travels as a complete unit with its disks still in their bays. A Fusion Mac is a third case — both of its drives come out and travel together, each one labelled. The single situation nobody can work around is memory soldered flat onto a mainboard, which is how Apple Silicon Macs and a good many slim laptops are built: if the storage will not unbolt, there is no parcel to send.

  • Use a box or padded mailer with some rigidity to it, and pack around the drive until nothing shifts when the parcel is tilted. Mains adaptors, docks and leads are not wanted at this end.
  • Sending a RAID or a server? Only the member disks travel — not the chassis, not the controller — and each one wants its bay number written on it. Take a photograph of the front of the unit before anything is pulled; it costs nothing and now and again it saves a day.
  • Print the shipping and booking-in form (PDF), add a name, a number you will answer and a sentence on how the trouble began, and drop it in beside the media.
  • Most people use Special Delivery, which is tracked and covered; a courier of your own does the same job. You can also bring it: the Oxford reception takes devices over the counter, Mon–Fri 9:00am–5:30pm. Neither a Coventry counter nor a collection round exists.
// write this on the label

Oxford Data Recovery

John Eccles House
Oxford Science Park
Robert Robinson Avenue
Littlemore, Oxford, OX4 4GP

↓ Print the shipping & booking-in form (PDF)

Put Oxford Data Recovery on the label. From Coventry it is roughly fifty-five miles straight down the M40, about an hour if you would rather drive it in than post it. Either way you are told the moment it is logged, and the free diagnostic finishes two working days later.

Unsure what ought to go in the box? Ring 0800 689 0668 before you seal it, or work through the free online diagnostic and let it do the asking.

A serial number is not an opinion.

Leave the computer switched off, keep hold of whatever came back in the desk drawer with it, and ring before somebody in IT decides to reformat a stick and reuse it.