External Devices and Intellectual Property Theft in Wilmington

by | Dec 29, 2016 | Blog, Uncategorized

Intellectual property (IP) theft is a major concern for businesses, with the greatest threat coming from employees. A 2009 study found that 59-67% of employees surveyed admitted to stealing data from their employers. With USB devices becoming smaller, more discreet, and able to hold massive amounts of data, it is relatively easy for unscrupulous employees to steal sensitive information. When litigating IP theft in Wilmington, uncovering the digital trail of these external devices can be crucial to proving your case.

On the Trail of External Devices

A thorough digital forensics examination in Wilmington will include searching computers, laptops, and servers for signs of external device use. It is not simply a matter of determining if a device was used, you also want to be able to prove who used the device and what data was transferred to it. To gather this information, digital forensics experts look at five key sources:

  1. The USBSTOR – This contains data on the brand of device used, as well as its serial number. This can be used to match the mounted drive letter (see below), user, and the first and last connected times of the device. The serial number can also be matched against any devices found during the course of an investigation.
  2. The MountedDevices key – Computers automatically assign letters (A-Z) to computer drives and drive partitions. External devices are also assigned a specific letter when they are attached to a computer. By matching the serial number of the device to the drive letter, a Wilmington digital forensics expert can track activity for that drive letter and the associated device.
  3. The MountPoints2 key – This shows which user was logged in and active when the external device was connected. Being able to link a specific user to the device is obviously key in pursuing a case against them.
  4. The USB key – This key verifies the vendor and product ID of the device, like the USBSTOR, but it also shows the last time the device was connected to the system, as well as the last time information, was copied to the device. This helps track patterns of theft or data manipulation.
  5. The setupapi log – Wilmington digital forensics experts can search this log for the serial number of the device in question and learn when the device was first connected to the system in local time. With definitive access times, attorneys can tie in the evidence of what users were active and accessing/using the stolen information at that time.

Precise: Wilmington’s Digital Forensics Experts

When it comes to uncovering IP theft in Wilmington, Precise’s digital forensics experts know where to look to uncover the information crucial to your case. If your case can benefit from the Precise difference, call and speak to one of our representatives today.