What are the chances that a Linux boot disc is being used on the computer? Then the USB drive could be accessed that way without being identified in Windows. Just a thought.
Regards,
Chris Currier
How do you know it was connected to that computer?
An absence of evidence relating to registry or setupapi.log information relating to usb artefact connection does not prove the device has not been connected to a pc, it may be the case that it was but the records have been deleted. I have seen this absence of data on many occasions, however in this case since other records are intact it seems unlikely that any efforts have been made to delete records relating to the device in question. I would suggest that searching for recovered folders or orpaned entries that relate to the files on the usb device may help (if you have access to the usb device) & I can see from reading your post that the device may be an external hard disk therefore the artefacts you are looking for relates to the devices volume GUID which is totally different to the USBstor artefacts relating to usb flash drive, this may be an important distinction in your case.
So talked with my boss about this and he wanted me to Thank everyone for their comments and is looking into the suggestions. After I told him about the comments on here he looked into them and thought that this person may have used some Anti-Forensics software.
The person said that this IO gear USb was the only one ever used to copy any type of material. Now they could be lying.
More to come!
After I told him about the comments on here he looked into them and thought that this person may have used some Anti-Forensics software.
If you don't mind the question, what did he have to support that? Also, this is easy to check…
Don't know we only talked about it last night for a minute and then started onto another case.
I will ask him though next time I go down there. I'm only an intern so I can't go everyday.