Is it possible to prove a hack done by a person with live usb?

Question

Boot disk

For example, some person hacks with live usb. A case is opened against him and they come with a search. It turns out that there are only provider logs, but there will be no real evidence, because live usb will clean everything up, or does it work somehow differently?

Answer 1

You can find live usb itself - it is useless to a simple person. Pieces of files on a flash drive can be saved. And the fact that the logs do not remain so it does not matter - the lack of logs of the regular system and the presence of provider logs - will prove the use of this very live usb. Traffic cannot come from nowhere. Examination of the router for hacking the firmware and its logs will also be needed - so that it does not turn out to refer to its hacking. If the hack is from a company, then the computer is also easy to find - MAC is stored in DHCP, and switches can indicate from which port the connection was made - up to the office. And there they will find someone on the cameras.