introduced a technique for identification of past pod slurping type of attacks using information stored in file system time stamp. This technique infers a file’s transfer rate from access time attribute and correlate it to the common rate of the suspicious USB (obtained from Windows registry) to identify the victim USB device.