USB sticks · memory cards · removable media · imaged · deleted files
USB stick and memory card forensics. The removable drive that holds the data, or that a suspect device is matched against, is an exhibit in its own right.
A USB stick or memory card is often central to a data matter, either as the media onto which data was put, or as a device recovered from someone and matched against a computer's USB history. We examine it as an exhibit in its own right: imaged behind a write blocker and examined for its live files, its deleted files, and the evidence it holds. A recovered device's serial number can be matched to a computer's record of connected devices, tying the two together, and the card or stick's own file system may hold deleted files and artefacts that bear on the matter.
Rather talk it through? An engineer answers the bench line
0800 6890668
How removable media is examined.
A USB stick or memory card is imaged bit for bit behind a write blocker and hashed, exactly as a computer's drive is, and the examination runs on the image. Its live files are examined, and its deleted files recovered where they survive, which on the flash memory in these devices depends on how the device and its controller handle deletion.
The particular value of a recovered device is its serial. Where a USB stick is recovered from someone, its serial can be matched against the record of connected devices in a computer's USB history, which ties the specific device to the machine and the dates it was connected. The device's file system may also hold the files that were put on it, and deleted files that were later removed.
We examine the media; we do not, of course, examine a mobile phone presented as a device, which is outside this service.
What to know for this exhibit.
From the exhibit arriving to the report.
Work we have closed →The first conversation, and the authority check Free
Tell us the situation, who owns the device, and what you need to know. We tell you whether it is a job we can take on, what authority we will need, and whether the standard report answers your questions or an expert report is called for. That conversation is free, and some enquiries end there, because we will not take work we cannot lawfully or honestly do.
Imaging behind a write blocker, and the hashes
When the exhibit arrives, your authority is checked, the device is logged and photographed, and the drive is connected through a hardware write blocker and imaged bit for bit. MD5 and SHA-256 hashes of the source and the image are computed and verified, so the copy is provably identical. Nothing is examined on the original; every later step is done on the verified image.
The examination, on the image
The image is examined for the artefacts your questions turn on: USB device history, files opened from removable media, cloud and webmail activity, deleted files and the Recycle Bin, the USN journal, program execution, email, document metadata, shadow copies, and a timeline. Findings that matter are confirmed in a second tool. The work is scoped to what you asked; material outside the scope is not reproduced.
The report
The standard forensic report sets out the exhibit and its condition, the integrity record, the tools and method, and the findings by category, with a timeline, the limitations, and factual conclusions, as a self-contained report with its chain-of-custody and case-log reports. It is written in plain terms, keeps fact separate from any comment, and is suitable for internal decisions, HR processes, negotiations and solicitors. Where you need opinion evidence for court, an expert report is quoted.
Before you send it
- Keep a recovered device as it is; its serial and its contents both matter, and using it changes the contents.
- Send it with the computer where both are exhibits; matching the device to the machine's USB history is often the point.
- Do not plug a recovered device in to look; that alters it and can undermine the evidence.
A recovered USB stick's serial can be matched to a computer's record of connected devices, tying the specific device to the machine and its dates.
What helps, and what harms.
Do this much first
- Stop using the device and keep it powered off
- Preserve it as it is; record who has held it
- Gather your proof of ownership or authority
- Tell us the situation and the questions you have
What sets us back
- Letting anyone open it to have a look
- Reinstalling, wiping or running recovery software
- Carrying on using the device
- Sending us a mobile phone; they are not examined
Questions answered before you instruct.
Can you match a USB stick to a computer?
Often, yes, by its serial number. A recovered USB stick's serial can be matched against the record of connected devices in a computer's USB history, which ties the specific device to the machine and the dates it was connected. Sending both as exhibits lets us make that match.
Can you recover deleted files from a USB stick or memory card?
Where they survive, yes. These devices use flash memory, and whether deleted files survive depends on how the device and its controller handle deletion; some retain more than others. We image the device and recover what is recoverable, and are honest about what is not.
Is a memory card examined the same way as a USB stick?
Yes, in principle: both are imaged behind a write blocker and examined on the image. Our sister service covers memory card data recovery in depth; for a forensic matter, we examine the card as an exhibit with the chain of custody and integrity record.
What will the device show?
Its live files, its deleted files where they survive, and, for a recovered device, a serial that can be matched to a computer. The report is a factual account of what the device holds, with the limits stated.
What does it cost?
The standard forensic report is £800 + VAT for a one-disk system; a USB stick or card examined alongside a computer is discussed with you. The first conversation is free.
Preserve it, and let us image it first.
The first conversation is free. Tell us the exhibit and the situation, and who owns it, and we will tell you what can be examined, what authority we need, and whether we can take it on. Until then, stop using it and preserve it as it is.