If the machine was wiped – It will be obvious. No history/activity artifacts present.
Otherwise, they’ll be able to match thumb drives to machines – where they were used if they were used. All software installed, data saved/altered on thumb drives / hard drive. Outbound access via network connectivity, inbound access via connectivity . . . everything.
1 comment
If the machine was wiped – It will be obvious. No history/activity artifacts present.
Otherwise, they’ll be able to match thumb drives to machines – where they were used if they were used. All software installed, data saved/altered on thumb drives / hard drive. Outbound access via network connectivity, inbound access via connectivity . . . everything.