Let's just guess that the hack was picked up and divided up among several thumb drives...then hand carried to different sites for downloading.
Tend to doubt that scenario. The time stamps would have 3-4 interruptions in them.
There would be 3-4 “unplug > plug” sequences.
A 2 GB thumb drive as I assume you know is a complete nothing. I don’t see any purpose in dividing the download among multiple thumb drives (or SD cards)