external drive forensics

Introduction — why portable drives matter USB sticks and external drives are everywhere: employees carry them, users back up to them, and threat actors use them to move data or implant malware. For investigators, these devices are often rich sources of evidence — file histories, hidden partitions, deleted data, timestamps, ...