There is potential forensic data here at least that there was a device plugged in and the device serial number.
A Linux based host will tend to do this [in syslog], unless turned off.
Most Windows hosts tend to not log these events by default, unless turned on. If the USB drive hadn't been plugged in before or Windows forgot, there could be an event log item where the drivers were installed/reinstalled. [A drive mount is event 4688 under system security]
If the voting machines were one O/S it's not impossible the servers weren't another.
Without forensic access to the server or a drive image, this information is worthless for election in dispute. Future election reform could include the requirement that any usb insertions be logged but by then they will just stop using usb drives.
There is potential forensic data here at least that there was a device plugged in and the device serial number.
A Linux based host will tend to do this [in syslog], unless turned off.
Most Windows hosts tend to not log these events by default, unless turned on. If the USB drive hadn't been plugged in before or Windows forgot, there could be an event log item where the drivers were installed/reinstalled. [A drive mount is event 4688 under system security]
If the voting machines were one O/S it's not impossible the servers weren't another.
Without forensic access to the server or a drive image, this information is worthless for election in dispute. Future election reform could include the requirement that any usb insertions be logged but by then they will just stop using usb drives.
I've worked in places where the usb ports were epoxied. 🙂