During an investigation on a Linux workstation, an analyst reviews /var/log/messages and finds the following entries around 14:07: 'kernel: usb 2-1: new high-speed USB device number 4', 'kernel: sd 6:0:0:0: [sdb] Attached SCSI removable disk', and 'systemd: Mounted /media/user/BACKUP'. Which conclusion is best supported by these log entries?