Statement: "If you load something from the net onto a USB stick, then there are no hints for the download on the laptop." So if you examine the laptop, then you would not find any traces for a download. Is that correct?
Yes and no.
Even with a direct download, the file is cached in RAM. With a larger file or full RAM, however, the memory is partially relocated to the normal hard disk, this is called a paging file. The will then be deleted when shutting down, but later may still be read out.
Normally this will not happen, but it could.
Depends on the download method. But browsers and most download tools would probably have to log at least the downloads. And the logs would be left behind accordingly.
But theoretically one would have to be able to develop an application that writes something first into the RAM and then directly to the USB stick without writing any of it to the hard drive.
If this is possible, there are guaranteed to be those who do it consciously or unconsciously.
There's no download protocol in my browser. There's nothing displayed. I also did not use a download tool. The download was only possible via the mouse buttons.
Download history, possibly website history are the most obvious places every layman sees.
If you do not load it directly on the stick, but still on the hard drive, remain even more tracks.
Then there are protocols from the router. Windows itself logs up / down data rate. If it was something big, a third party would at least know that something was loaded.
The system may also log which IPs were visited, regardless of the browser. But those are already places in the system would rattle off ne forensics.
