USB and Portable Media Forensics

Where copying is suspected the questions are narrow. Which device. Connected during which hours. Carrying what. Windows supplies most of it without being asked. Off a verified copy we lift those answers and put them in order, for employers right across the North East, from processing plants at Peterhead and Fraserburgh to survey operations at Dyce.

Footing first. Bench time after. The free diagnostic opens the job, a written scope follows it, and forensic fees clear ahead of any examination. No fix, no fee all jobs except electronic and mechanical failures, chip level work, DVR and Forensic jobs. Full pricing is on the data recovery cost page.

// when a stick is the whole argument

The disputes this examination settles

Sticks, cards and portable drives land at the centre of more arguments than anything else we get sent.

A stick appeared on the desk in the last fortnight of employment
Serials show up in the device register that nobody recognises
The departing employee says the drive was theirs, files included
The case rests on a card out of a camera, dashcam or survey drone
A portable SSD left the building on a Friday and stayed away
Point-blank denial that any device was ever connected at all

A register of everything ever connected

Windows makes a note of each portable device it meets. USBSTOR takes maker, model and serial number for each stick, card reader or external drive. setupapi.dev.log pins each first appearance to the second. Other registry entries connect a device to whichever profile mounted it, and record the last sighting. Extracted off a verified copy, that register spans the machine's whole working life, hardware included that nobody thinks to mention until it appears on a schedule.

Getting named files onto a named device

Presence is one thing. A case normally needs movement. LNK records and jump lists capture company documents opened from whatever letter the portable volume was handed, with paths and times still attached. Shellbags keep the folder tree somebody walked through on it, long after the hardware disappeared. The change journal orders the surrounding activity minute by minute. Produce the stick as well and its own image finishes the account: current contents, arrival times, and whatever has been stripped off since.

Reading transfer stamps properly

Timestamps repay attention, because copying leaves a signature all of its own. Copy a file to a second volume and the created stamp records the moment of the copy while the modified stamp travels along untouched with the contents. So a document apparently created at 02:07 but last modified three years earlier is reporting the copy and not the writing. Put it next to the register and the journal and every transfer acquires a date. A run of them outside working hours seldom looks like housekeeping.

Cards, external SSDs and everything else

This discipline reaches well past sticks. SD and microSD out of cameras, dashcams and survey drones. CF cards from older equipment. External SSDs. All of it goes through identical imaging and identical analysis. Memory card forensics works in both directions here: documents traced onto a card, and deleted stills and video recovered off one. Where the card is the whole case, it gets worked next to whichever machine wrote to it, so each account keeps the other honest.

Custody and method belong to the forensic recovery hub. For dating a deletion, carry on to deleted-file forensics. The employer casework this feeds is employee data theft. Figures are on the prices page.

// what comes back in writing

Portable-media findings, one at a time

Each finding arrives with a date, the account it belongs to, and its supporting artefact.

The register

Each stick, card and drive that machine has ever met, by maker, model and serial.

Connection dates

First appearance and last sighting for each device, fixed to the second.

Opened-from traces

Documents opened off the device letter, with paths and hours attached.

Folder tree

The directory structure walked through on the device, held in shellbags.

Transfer signatures

Stamp patterns that put a date against each copy onto the device.

Card and SSD images

The media captured in its own right, with its deleted contents returned.

// the price, and who we may act for

Forensic fees, and the footing underneath them

The money, stated plainly

Each instruction opens on the free diagnostic. Allow 2 working days from the date a device reaches this bench. Forensic casework sits outside no fix, no fee. The full forensic investigation with report is £800 + VAT, payable 100% upfront. The less expensive Forensic binary image and deleted-file extraction service, without the report, is £400 + VAT. Any Forensic work required will be payable upfront. You will find both figures repeated on the prices page, and we take nothing until a scope is agreed in writing.

The footing we need

Portable-media work runs across company machines and company-issued media, or on written instruction from a solicitor. Three doors in, and we have never found a fourth. Kit the business itself owns. A written instruction out of a solicitor, an insurer or from the court. Or else a device that genuinely belongs to the client, which in a matrimonial matter takes in one held between the two of them. Nothing gets hacked at this bench. Live traffic is never intercepted. Where the instructing client holds no right to look inside a device, we hold none either.

// getting your device to us

Getting it to the bench — plainly done

A stick, plus whichever machine wrote to it, is best looked at as a pair. Ring 0800 689 0668 and we will settle the set between us. Collection is not on offer, so every item comes to Edinburgh tracked and insured, or across the counter, and enters the custody log on signature.

Still bolted into a laptop, desktop, MacBook, iMac, server or CCTV / DVR box? Get the hard drive or SSD out first. The bare drive travels on its own. Stripping machines down is not a job this lab takes on. Flash soldered to a motherboard, as on Apple Silicon Macs and a couple of very thin laptops, is our one flat no: if it will not unbolt, it cannot be worked on.

  • Bubble wrap, then a rigid box or padded envelope packed tight enough that nothing rattles. Keep the cables, caddies and power bricks at home.
  • Print the shipping & booking-in form (PDF). Name, mobile number, two lines on what went wrong. In the box with the drive.
  • Royal Mail Special Delivery is tracked and insured door to door. Your own courier account does the same job if you would rather use it.
  • Handing it over yourself instead? Reception takes drop-offs at the address below, Mon–Fri 9:00am–5:30pm.
// where your device is headed

Edinburgh Data Recovery

4 Redheughs Rigg
Westpoint, South Gyle
Edinburgh, EH12 9DQ

↓ Print the shipping & booking-in form (PDF)

Address it for the attention of Edinburgh Data Recovery. From Aberdeen that is roughly 130 miles and two and a half hours down the A90, or next working day by tracked post if you would rather not make the run. You get a call the moment it is booked onto the bench.

Not sure what belongs in the box? Ring 0800 689 0668 before you tape it shut, or work through the free online diagnostic.

// portable media · asked before instruction

What comes up when a stick appears

The machine alone takes you a long way. Register, connection hours, opened-from traces and transfer signatures are all held by the computer. All the stick adds is confirmation of contents. We say openly which conclusions rest on the machine by itself, and which would firm up if that device ever surfaced.
Yes. Its image shows current contents, the stamps that date the copying, and anything stripped off since, a tidy-up before hand-back included. It also allows the contents to be hash-matched against your originals.
Any serial in that register attaches to a machine, a profile, and a run of connection hours. Getting a particular hand onto the keyboard is work for the case as a whole: HR files, door logs, statements from witnesses. Reports here say openly where the technical evidence runs out.
Not unless there is consent, a protocol settled between solicitors, or an order of the court. Property belonging to the employee is out of an employer's reach. Whatever the company machine noted about that stick is company property, and on its own it usually carries the bulk of the story.

A serial number is a fact. Theories come later.

Leave the machine where it stands, keep hold of the stick, and ring the freephone.