Not quite the false charge but in defense against being falsely charged. That's why you always boot into a forensic-type OS on CD before examining that USB sti

Not quite the false charge but in defense against being falsely charged. That's why you always boot into a forensic-type OS on CD before examining that USB stick that you found in a parking lot at work. Also, I caught someone having had forbiddingly inserting a USB stick into a "white lab" PC. Which was a seldom used cybersecurity defensive practice to detect for (USB insertion) back in 2004. It was a simple matter of a rsyslog plug-in using encrypted tunneling for its syslog messages to a remote log server. (He wryly did say, "I did not see that" and was eventually released on unrelated charges). It's hard work to do all that because it's multiple layers ... of integrity, reporting integrity, that protects the innocent parties (as well as nabbing the guilt ones).