: Registry keys (like USBSTOR ) reveal that a specific Kingston USB drive was plugged into the machine shortly before the "data leak" occurred.
: Frequently found using Steganography tools or by checking alternate data streams (ADS).
: If an Outlook PST file is present, investigators look for communications with "competitors" or external email addresses where company secrets might have been sent. Common Solutions (Flags)
: Investigators identify the primary user account as Erin and examine the directory structure under C:\Users\Erin .