Have you ever been asked to find out what the "F" drive is? Have you ever needed to prove a USB drive was attached to a target system? Collecting and presenting this information is a core skill all computer forensic analysts need know. This episode breaks down the process of collecting and interpreting the data necessary to make the connection between USB device and Windows systems.

In this episode we examine how to use Windows Shellbag records to help prove file use and knowledge. Shellbag records are created by certain user activity and can be used to show where a user has navigated to on a computer system and when they did so. Very powerful evidence!

Windows Prefetch data is a great source of evidence to help determine file use and knowledge of applications running on the system.