GUIDE · BUSINESS EDITION

Keep the USB stick, add the proof

In most laboratories the instrument PC is kept off the network and the results leave it on a USB stick. The stick is not the problem an auditor asks about. The question is what left, what arrived, and how anyone knows they are the same file. Kionel answers that without changing how the file travels.

Written by Taha Bayar, a biologist working on laboratory data handover.

How to do it

1. On the instrument PC, open Kionel (the offline package works), choose the file, enter the work order and press Seal without transferring. The PC signs a record of the file's SHA-256, size, time and work order. Download it: result.csv.seal.json.
2. Carry both, the file and its sealed record, the way you do today: on the stick, over a share, by hand.
3. On the receiving device, open Receive, add the sealed record and then the file. The device checks the file against the record. If they match, it signs the delivery receipt; if one byte differs, it says so and signs nothing.

Both devices need a business licence: the sending device to seal, the receiving device to sign.

The sealed record is a few hundred bytes. If you would rather not put it on the stick, show it as a code on the instrument PC's screen and scan it with the receiving device's camera; the file can still travel on the stick.

What you have afterwards

• A dispatch record signed by the sending device: which file, how large, when, for which work order, declared by which operator.
• A delivery receipt signed by the receiving device over that record: exactly this file arrived here.
• A transfer log on both sides and a one-page report. The verifier can compare the two logs and list every sealed file with its receipt, or without one.

These are the same records an optical transfer produces, and the same free verifier checks them, offline and without us. One licence covers every route: screen, one-way cable, printed pages, or the stick.

What this does not do

• It does not encrypt the file on the stick. The file travels outside Kionel. Kionel shows that what arrived is what was sealed; it does not hide it on the way. If the content must stay confidential in transit, use the optical route, which encrypts before the first image is shown, or an encrypted stick.
• It does not control the USB port. Someone can still copy a file to a stick without sealing it. Port control is the job of the site's device-control software; Kionel records the handovers that go through it.
• It does not scan the stick. A stick is removable media, with everything NIST SP 1334 says about scanning, labelling and wiping. If the reason for leaving USB is malware, a record does not help; the optical route or a one-way cable does.
• It does not identify a person. The records show which keys signed and what the operator declared.

Questions people ask

How do I create an audit trail for files moved by USB stick?

Record what left and what arrived, and tie the two together. With Kionel the sending PC signs a sealed record of the file's SHA-256, size, time and work order before it leaves; the receiving device checks the file against that record and signs a delivery receipt. Both devices keep a transfer log that can be exported.

How can I prove a file was not changed on a USB stick?

Compare its SHA-256 on arrival with the SHA-256 recorded before it left. A signed record makes that comparison checkable later: the receiving device signs only if the two match, and anyone can verify both signatures offline.

Does this replace USB device control or malware scanning?

No. It does not lock ports, decide which sticks may be used, or scan content. It records the handover. Use it alongside the site's device-control and scanning tools.

Is the file encrypted on the stick?

Not by Kionel. On this route the file travels as it is. Use an encrypted stick, or the screen-to-camera route, which encrypts before the first image is shown.

Does it need a network or an installation?

No. It runs in a browser tab. For PCs that never go online there is an offline package: one HTML file with a published SHA-256.

How this compares with device-control software, media kiosks and compliance wrappers: audit trail for USB transfers, the options compared.

Which route when