The Departing Engineer: Tracing IP Theft Through USB Artifacts and Shellbags
A senior engineer resigned and joined a direct competitor within a week. Windows shell artifacts and USB registry entries reconstructed exactly what he took on his way out.
Background
A mid-size industrial design firm suspected that a senior mechanical engineer had copied proprietary CAD files before resigning to join a direct competitor. Legal counsel authorized a forensic examination of the employee's company-issued laptop under the terms of the signed IT acceptable-use policy, which permitted post-employment device review.
Evidence Seized
- Dell Latitude company laptop (Windows 11, BitLocker enabled with recoverable key in escrow)
- Domain login and VPN access logs for the 30 days preceding resignation
- Corporate file-server access logs (SMB share audit trail)
Tools Used
- FTK Imager (imaging)
- Autopsy + Registry Explorer (artifact analysis)
- USB Detective (USB history correlation)
- log2timeline / Plaso (super-timeline)
Methodology
- Escrowed BitLocker recovery key retrieved from Active Directory and used to mount the volume for imaging without altering the source disk.
- Created a forensic image with FTK Imager and verified SHA-256 hash matched pre- and post-acquisition.
- Parsed SYSTEM and SOFTWARE registry hives to enumerate USBSTOR and USB device history — vendor ID, serial number, first/last connection timestamps.
- Extracted shellbags from NTUSER.DAT and UsrClass.dat to reconstruct folder-browsing history, including folders that had since been deleted from disk.
- Cross-referenced shellbag folder-access timestamps against USB connection windows to identify which folders were browsed while a specific USB serial number was attached.
- Reviewed Jump Lists and LNK files for direct evidence of specific CAD files being opened from the removable volume.
- Built a super-timeline in Plaso combining registry, filesystem MACB times, and event logs to present a single defensible narrative.
Key Artifacts Found
- Three distinct USB mass-storage device serial numbers connected in the 72 hours before resignation, none previously seen in six months of history
- Shellbags showing navigation into a folder named 'Confidential_Prototype_2025' that was deleted from the local disk but never existed on the removable media's file allocation table snapshot at seizure
- Jump List entries referencing eleven specific .SLDPRT (SolidWorks part) files opened directly from a drive letter matching one of the flagged USB serials
- $LogFile and $UsnJrnl entries showing bulk file creation events in a temp folder followed by rapid deletion, consistent with staging files before copying and cleaning up afterward
Challenges
- BitLocker required coordinating with IT to retrieve the escrowed recovery key before imaging could begin, adding a two-day delay that had to be documented in the chain-of-custody log.
- The employee had run a registry cleaner utility, which complicated — but did not defeat — USBSTOR reconstruction, since MountedDevices and setupapi.dev.log retained corroborating entries.
- Shellbags alone don't prove file copying occurred, only that folders were browsed; this had to be clearly caveated in the report and paired with Jump List and $UsnJrnl evidence for a complete picture.
Outcome
The combined artifact timeline was sufficient for outside counsel to send a cease-and-desist supported by specific, dated technical findings. The matter was resolved through a confidential settlement before litigation was filed.
Lessons Learned
No single artifact type proves data exfiltration on its own — shellbags, USB history, Jump Lists, and journal records each have narrow individual meaning but corroborate powerfully when triangulated into one timeline. Escrowing full-disk-encryption recovery keys before an incident occurs is what made rapid imaging possible at all.