I have not read that article before. Thanks, good read. I worked on this case again and the person did a good job of getting rid of stuff related to this device.
The device is called "Ion 1" whether this be a external drive or thumb drive we don't know yet. I was using Encase last night and I found 24 references in unallocated space related to this Ion nd you can see the files that were accessed. Like Ion 1 F: users/verizon/contracts or F: users/..../Powerpoints.
So she was clearly moving files to it.
Security+, Network+, C|EH, CHFI, CPT