I'm concerned that someone might have taken confidential images from my work computer and copied them to an external hard drive while I was away. Is there a way for me to check if this happened and identify what images were taken? Thanks for any help!
2 Answers
If you can find the external drive they used, that could be a start. But otherwise, you might want to check the Event Viewer for logs during the time this happened to see if a USB device was connected.
Honestly, finding out if files were copied can be tough without security or auditing software set up beforehand. Windows doesn’t keep a log of file copies automatically. You might be out of luck here unless you had something in place.
I did check the logs, and there is indeed a record of a USB device being connected. Is there anything else I can do?