I was reading this post on Slashdot which talks about the process of gathering evidence from a computer as part of an investigation. The post mentions being able to see the history of devices connected to a computer when doing forensics work, as well as which files were transferred to which devices:
But as we dig deeper, we'll begin to look at devices that were connected to the operating system. We'll match up the devices in our possession with the ones recorded by the os. We'll look for behavioral patterns of file movements from the OS to the device and then back.
Is it possible to see device history and which files were transferred to a given device when doing computer forensics? If so, which tools allow you to see this?