"USB device history can be a great source of evidence when an examiner needs to determine if and why an external device was connected to a system. It can also help investigators understand how USB devices have been used on a given system, and possibly explain how a suspect might have used a USB device in the commission of a crime or incident." - Magnet Forensics
Digital Forensics: Artifact Profile – USB Devices - Magnet Forensics
Practical Guide to USB Forensics – Data Breach Test Case by Tal Eliyahu
Get exclusive access to online courses and content through Patreon !