Notifications
Clear all
General (Technical, Procedural, Software, Hardware etc.)
2
Posts
2
Users
0
Reactions
504
Views
Topic starter
23/07/2008 10:05 am
I want to prove that a document was copying from a computer to removable media (USB stick).
I found a link file for this document to the removable media and a Windows registry entry for the removable media was used on this computer.
Is there any other method other than above to prove that this document was copied to the removable media, such as logs, etc?
I'm a FTK and EnCase user.
Regards
21/08/2008 12:49 pm
It's late, but perhaps not too late
perhaps you can check on the computer what files were opened at the same time as the timestamp of the link to the document.
It's not a proof, but could help and give some hints.
You can also check the "recent" files in Word, perhaps there is a proof (link) from the document to the external media.
Regards
Chris