Would you mind elaborating on this hypothesis?
Shortcuts contain the volume serial number and label of the target partition. They also contain the system name and MAC address of the target system.
If the user created a shortcut on the external drive to a file on the host system, the link file may have the above information showing a link.
While I agree that *if* such a shortcut/LNK file is found, then it would prove beneficial. However, if a user were to copy/move files over to the external drive and then double-click the file to view it's contents and ensure that it was copied correctly, the shortcut/LNK file would be created in the user's profile, pointing to the external storage device...it wouldn't be created on the external storage device.
Obviously. But he don't have the host system, just the external drive. I was giving a possible way to link the external drive to a host system. Once the link is established, maybe he can expand scope to find the host system (search warrant or something).
But, without the host, proving files were copied to/from is nigh on impossible since there is no reference point.