Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Possible Duplicate:
How to find out WHEN a usb disk was removed?

Recently someone stole my external hard drive. I suspect a friend of mine might have done that – I have access to his computer.

I have never given my hard drive to my friend. I guess Windows might register the hard drives that are connected to it, so is there a way to find out which hard drive is has been connected, the time it was connected (optional) to the Windows system, using either the hard drive's name or serial number?

share|improve this question

marked as duplicate by Ƭᴇcʜιᴇ007, Simon Sheehan, HackToHell, Hennes, Diogo Dec 17 '12 at 13:15

This question was marked as an exact duplicate of an existing question.

Did you really write "friend"? – Xavierjazz Dec 16 '12 at 19:57
Instead of trying to snoop in their registry, just take the whole system hostage until they give your drive back. – Synetech Dec 17 '12 at 6:44
@Synetech And wind up being arrested for breaching a variety of unauthorised access laws? Two wrongs don't make a right. Theft is illegal, go to the cops instead of trying to be a vigilante. – Polynomial Dec 17 '12 at 10:43
I guess if you got it back you could try and recover deleted files from it - this would then give you an indication if all the deleted files were your old files! – Dave Dec 17 '12 at 11:37
@Polynomial, hole cow, calm down. I was being faceicious (and I don’t see you freaking out about the idea of snooping in someone else’s computer, which is also illegal). I think you have misunderstood the issue. If his friend really did take his drive, then he isn’t in a position to complain. Also, you may be envisioning some corporate scenario while it is more likely to be roommates or buddies, so they are not enemies across town; it would be easier to take the system hostage by locking himself in his friends room than actually taking it—and thus take all of his friends stuff hostage. – Synetech Dec 17 '12 at 15:48

Do you have physical access to the system you suspect? If so, there is a question on the it security site about this. If you don't, then no. You would have to have some sort of Trojan that would call home (aka send email updates), but they won't always work on hard drives since it would have to run once plugged in.

share|improve this answer
yes i have access to to the suspected system please do give me any link related to this question – abhinav kumar Dec 16 '12 at 17:47

Sorry to say, but the answer is no. Unlike smartphones today, hard drives don't have that option (yet). Only direct access to the computer your hard drive was connected to could show you what you are looking for, but there is no automatic online protection system for hard drives in that way.

share|improve this answer
i have access to the suspected system i guess if he had stolen it he would have connected it too. is there a way to find the drive's name or serial number that is connected to pc(i have access to the comuter) – abhinav kumar Dec 16 '12 at 17:55
This is the question with similar result - link. If you have admin rights on that computer the answer in the link should help you. – sachiel6 Dec 16 '12 at 18:05

Find the serial number of your hard drive by requesting it at the store where you purchase your external hard drive, using your original receipt.

Most external hard drive enclosure require some kind of USB driver. Even so if this information itself is not enough, if the person did open any document from the external hard drive, there is some trace in the computer cache.

Circumstantial evidence can be gathered but this being said, 'investigating' someone else computer without is consent cannot server as evidence.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged .