A padlock can appear beside a website that is trying to scam you. That’s because HTTPS doesn’t mean a website is trustworthy. HTTPS mainly protects the connection between your browser and the website by encrypting the data traveling between them. It also helps your browser verify that it is communicating with the domain named in the website’s certificate. But HTTPS doesn’t tell you who operates the website or whether you should trust them. A phishing website can get a valid HTTPS certificate too. Once the certificate is valid for that domain, the browser can show the padlock even if the site is designed to steal your password or money. So when you see HTTPS, think: “My connection to this website is encrypted.” Not: “This website is safe.”

You can remove a USB drive from your Windows PC, but Windows may still remember that it was ever there. Every time a USB device is connected, Windows can create records in the Registry containing information about that device. Depending on the device and Windows version, this can include the manufacturer, product name, hardware identifiers, and serial number. Some of the locations forensic investigators examine include: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR Other Registry locations and Windows logs can provide additional information about the device, including connection activity, assigned drive letters, and volume information. This becomes particularly interesting during a digital forensic investigation. Imagine a USB flash drive is used to copy files from a computer and is later removed. The physical device may be gone, but traces of its connection can remain on the computer. An investigator can potentially use those artifacts to establish that a particular USB device was connected to the system and correlate that information with other evidence such as file timestamps, Windows event logs, and user activity. That doesn’t mean the Registry gives investigators a perfect timeline of every USB connection. Different Windows versions, configurations, device types, and cleanup activities can affect what remains and how reliable each artifact is. But that’s the important lesson: Deleting the device doesn’t necessarily delete the evidence that the device was there. Windows can remember more about your USB history than you might expect.

That little “Accept Cookies” button is doing more than just getting you past a pop-up. A website can use cookies to remember that it’s you when you come back. Without them, many websites would treat every page load like a completely new visit. You might have to log in again, lose items in your shopping cart, or reset preferences. But not all cookies exist just to make websites convenient. Some are used for analytics, advertising, and tracking how people interact with websites. A site can use them to understand which pages you visit, what you click, and how you move around the site. That’s why the message isn’t always simply “Accept cookies.” Depending on the website and applicable privacy laws, you may also see options to reject certain cookies or manage your preferences. And there’s an important distinction: Cookies themselves aren’t automatically bad. The interesting part is what information they store, who can access it, and what they use it for.