Say what you are trying to establish. This gives you the sources that would establish it, in the order to collect them, with the ones that expire first at the top, and the source people commonly reach for that does not actually settle the question.
An external device was attached and files were moved to it.
Collect first, these expire. The change journal rolls by size and is what shows files moving to a volume that has since been unplugged. Hours on a busy host.
Device connection records on their own. Knowing a drive was plugged in is not knowing anything was written to it: the LNK volume serial and ShellBags are what tie a file to a specific device.
if you find nothing
ShellBags survive the drive being removed and often preserve the folder structure of a device you will never see, which makes them the best starting point rather than the last resort.
Worked a case where this list was wrong or incomplete? That is worth more than the list is. Say so.
