[srfilipek]

It provides some indication that it may have been transferred to USB at some point.

That point could be directly from the server, or from the hacker's computer to a USB drive, or from a USB drive to another computer.

It says nothing about the original hack.