Sample report: a departing employee's company laptop. What the laptop recorded in the final week, set out as fact.

The company asked: (a) whether removable storage was connected to the laptop between 1 May and 12 June 2026 and, if so, what; (b) whether company documents were opened from removable media or uploaded to personal cloud or webmail services; (c) whether files were deleted in the final days; and (d) for a timeline of the last week of use. The examination was of the device only; no accounts belonging to the user were accessed.

The laptop is company property, confirmed in writing by the managing director, with the lawful basis stated as the company's legitimate interest in protecting its confidential information. The company's acceptable-use and monitoring policy, supplied, tells staff that company devices may be examined. Personal material encountered outside the scope, two folders of family photographs and personal banking bookmarks, was not opened beyond what was needed to classify it and is not reproduced.

OSForensics for User Activity, Deleted Files Search, the $UsnJrnl, Prefetch, event log and registry viewers, and the case report; Autopsy to confirm the USB device list and the jump-list findings in a second tool; FTK Imager for acquisition and verification. The system clock was set to GMT Standard Time; all times are UTC, with local time one hour later during British Summer Time. The drive is an SSD that reports TRIM support, which limits deleted-file recovery, as section 7 explains.

Three USB storage devices are recorded in the registry and the Partition/Diagnostic event log. Two were first connected in the final four days of the period: a Kingston flash drive on three evenings, and a Seagate portable hard disk once, for just over two hours.

Thirty-one jump-list, shortcut (LNK) and shellbag entries reference paths on volumes whose serials match the Kingston drive (E:) and the Seagate drive (F:). The folder names correspond to folders in the user's company OneDrive. Representative entries follow; the full list is at Appendix D.

A personal Dropbox client was installed on 10 June 2026 at 19:14 UTC (installer in Downloads; installation event in the Application log). Its logs record about 1.8 GB uploaded across 10 and 11 June; file names are not stored in those logs. Browser history shows sign-ins to a personal webmail service on 9, 10 and 11 June, and three visits to a file-transfer website between 20:10 and 20:38 UTC on 11 June, with no matching downloads. That pattern is consistent with uploading, but it does not show what, if anything, was sent.

The USN journal records 412 delete operations under the user's account on 12 June 2026 between 15:50 and 16:30 UTC, in the local Documents\NF folder and the OneDrive folder; the Recycle Bin was emptied at 16:31. Deleted Files Search recovered 58 of the 412 files with a quality indicator above 80; the remainder returned zeros, consistent with TRIM on an SSD. Recovered files were hashed and supplied; none was opened beyond confirming its type.

The artefacts show that the devices were connected and that the named files and folders were opened or existed on them under the user's account. They do not show who was at the keyboard, and Windows does not log copy operations, so they do not show that files were copied or later used. The cloud and transfer-site activity shows volume and timing, not content. TRIM has removed most deleted file content. The system clock was checked against the examination workstation and found accurate to within one minute.

Within the scope: two removable storage devices were first connected in the final four days; folders and files bearing the company's client, pricing and quote folder names were opened from them; a personal cloud client was installed and uploaded about 1.8 GB over two evenings; a file-transfer site was visited; and 412 files were deleted and the Recycle Bin emptied on the final afternoon, 58 of which were recovered.

Exhibits: E1 laptop, returned resealed; E1/IMG1 forensic image, retained encrypted for 90 days; E1/REC recovered files, supplied on encrypted media. Appendices: A acquisition log; B tool versions and case-log extract; C recovered files with hashes; D removable-media artefacts in full; E glossary.