Member Avatar for london-G

Hello,

I had all my work on my USB stick, however I lost it and someone else found it. The thing is that I think that this particular person has transfered my work onto his laptop. Is it possible to check if any file were transfered from my flash?

  • 2 Contributors
  • 1 Reply
  • 129 Views
  • 4 Days Discussion Span
  • Latest Post Latest Post by mjdodd

Dani AI

Generated

Short answer: you usually cannot prove a copy was made from the flash stick by looking at the stick alone. 's suggestion to check file metadata points in the right direction, but file metadata on the USB is neither definitive nor tamper-proof. Conclusive evidence requires examining the machine that received the files or using a forensic comparison.

If you can examine the other PC, be systematic:

  • Search for your filenames and for distinctive text strings from your documents (full-text search, downloads folders, and cloud-sync folders).

  • Compute strong hashes on files from your USB and on any candidate files found on the PC; identical hashes prove the files are the same. Example commands you can run on Windows:

    Get-FileHash -Algorithm SHA256 "C:\path\to\file"
certutil -hashfile "C:\path\to\file" SHA256

  • Check application recent-file lists, browser download history, Recycle Bin, and sync clients (OneDrive/Dropbox). System logs and device-install records can show that a USB device was attached, but interpreting those requires care.

If you do not have access to that computer:

  • Search the web for unique phrases from your documents (to detect postings).
  • Check your cloud/backups and any shared accounts for copies.
  • Assume sensitive material may be compromised: reset passwords, revoke keys, and inform your employer or clients if applicable.

If the loss has legal or business consequences, stop tampering with evidence and consult a digital-forensics professional. Small, local checks can help, but robust proof and an admissible chain of custody require specialist handling.

Member Avatar for mjdodd

most files have attributes (eg read only, hidden etc) right click on the file in the usb stick and go to properties and one of the attributes is 'last accessed date' that will tell you when the file was last used (copied or altered, / accessed)
M

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.