Could a peripheral contain its own logs or storage?¶

Yes. A peripheral may retain configuration, logs or user data independently, so the connected computer is not always the only evidence source.

Peripheral does not mean passive¶

Printers, scanners, cameras, docking stations, displays, audio devices and input hardware can contain firmware and memory. Depending on the device, records may include recent jobs, paired devices, network settings, user accounts, timestamps, cached content, error history and access events. A networked or cloud-managed peripheral may continue operating after the main computer is disconnected.

The absence of a visible memory-card slot does not show that no internal storage exists. Equally, the theoretical ability to store data does not establish that useful records are present or retained for a particular period.

Preserve state before investigating capability¶

Record the make, model, serial number, asset tag, power state, display, activity lights, ports and every connection. Photograph attached adapters and removable media. If a control panel or management interface is already visible, capture it before navigating.

Do not reset, reconnect, update firmware or dismantle the device to explore it. Those actions can clear logs or change configuration. Seek specialist support where internal extraction may be justified, and interpret any account, job or pairing record as a technical association rather than automatic identification of a person.