USB Flash Drive and Memory Card Forensic Examination

Company data often leaves the organisation on a small, easily hidden USB drive or memory card.

File activity and timestamps on the media can show when data was written to it and what happened next. This is often the shortest route to understanding how an incident unfolded.

• Write-protected imaging verified by hash value
• Examination of the existing file and folder structure
• Analysis of created, modified and accessed timestamps
• Detection of deleted or hidden files and recoverability assessment
• File system and unallocated space analysis
• Assessment of formatting traces
• File metadata analysis

Flash media may be small, but file system records hold detailed traces. When searching for deleted data we assess file system records and raw data areas together.

1. Intake and custody: we confirm the requester's legal authority, sign a non-disclosure agreement and receive the material with a signed evidence handover record. The chain of custody is documented from this point on.
2. Forensic imaging and verification: a bit-for-bit forensic image is acquired through a hardware write blocker, and its hash value is calculated and recorded to verify that it matches the original.
3. Analysis: file system timestamps, deletion and formatting traces and file metadata are examined and, where needed, correlated with records from the relevant computer.
4. Reporting and return: findings are reported together with the scope and limitations of the work. The material is returned against a signed record and working copies are either not retained at all or kept for 3 or 6 months, as the client prefers, and then securely destroyed.

Duration varies from case to case depending on the type of device or material, the data volume and the scope of the examination. We share an estimated timeframe after the initial assessment.

Organisations with a suspected data leak, parties to commercial disputes and law firms.