0

I downloaded files from an old company computer to an external USB device, can the company tell which files were copied or only that I copied files?

user155513
  • 1
  • most likely they can't tell exactly what you did. – dandavis Jul 29 '17 at 00:07
  • While the question itself is not exactly the same, the answers still fully apply: [Can my employer see what I do on the internet when I am connected to the company network?](https://security.stackexchange.com/questions/142803/can-my-employer-see-what-i-do-on-the-internet-when-i-am-connected-to-the-company) – WhiteWinterWolf Jul 29 '17 at 09:57
  • 1
    Possible duplicate of [How to detect if files were saved or copied from an external hard drive/USB?](https://security.stackexchange.com/questions/120409/how-to-detect-if-files-were-saved-or-copied-from-an-external-hard-drive-usb). It's quite unlikely that they will know what you copied, unless they use [DLP](https://security.stackexchange.com/a/52851) but they probably will know that you attached a USB device, since [most enterprises log that](https://security.stackexchange.com/questions/12741/how-can-you-see-the-device-history-of-a-computer-when-doing-forensics). – Jedi Jul 30 '17 at 03:27

1 Answers1

1

This depends on how they might go about checking it, if for example they where to use a full Forensics examination then there would be registry information stored for, when the device was connected. And from there using a software such as FTK or EnCase it would be possible to see the signature of that devise and potentially follow the files signatures and path.

Mike Johnson
  • 108
  • 7
  • however, this would only tell them that the device was plugged in, it would not tell them if any files were copied – MikeSchem Jul 29 '17 at 01:31