The increase in the use of USB storage devices tends to be massive & exponential due to various aspects, one of which is the size and affordable price of USB storage devices. Currently, the quality of handling cybercrime in Indonesia is still minimal, starting with the problem of collecting evidence that tends to be incomplete, errors during the process of acquiring evidence to the most severe loss and damage to the evidence. Static Forensics is one type of digital forensics method that obtains digital evidence by extracting and analyzing it after an incident occurs, or after the computer system is turned off (post-incident). The NIST Framework is a reference for the digital evidence retrieval and processing process, which was developed by the National Institute of Standards and Technology. The results obtained from the analysis of digital evidence recovery using static forensics methods combined with the NIST framework can be applied properly and optimally. The test was carried out 20 times, with the results of the digital evidence recovery accuracy reaching 100% on the three devices. Therefore, a combination of methods, frameworks and related tools is recommended to process cases related to digital forensics, especially the digital evidence recovery process.