0

Possible Duplicate:
How to find out WHEN a usb disk was removed?

Recently someone stole my external hard drive. I suspect a friend of mine might have done that – I have access to his computer.

I have never given my hard drive to my friend. I guess Windows might register the hard drives that are connected to it, so is there a way to find out which hard drive is has been connected, the time it was connected (optional) to the Windows system, using either the hard drive's name or serial number?

6
  • 3
    Did you really write "friend"?
    – Xavierjazz
    Dec 16, 2012 at 19:57
  • Instead of trying to snoop in their registry, just take the whole system hostage until they give your drive back.
    – Synetech
    Dec 17, 2012 at 6:44
  • @Synetech And wind up being arrested for breaching a variety of unauthorised access laws? Two wrongs don't make a right. Theft is illegal, go to the cops instead of trying to be a vigilante.
    – Polynomial
    Dec 17, 2012 at 10:43
  • I guess if you got it back you could try and recover deleted files from it - this would then give you an indication if all the deleted files were your old files!
    – Dave
    Dec 17, 2012 at 11:37
  • @Polynomial, hole cow, calm down. I was being faceicious (and I don’t see you freaking out about the idea of snooping in someone else’s computer, which is also illegal). I think you have misunderstood the issue. If his friend really did take his drive, then he isn’t in a position to complain. Also, you may be envisioning some corporate scenario while it is more likely to be roommates or buddies, so they are not enemies across town; it would be easier to take the system hostage by locking himself in his friends room than actually taking it—and thus take all of his friends stuff hostage.
    – Synetech
    Dec 17, 2012 at 15:48

3 Answers 3

0

Do you have physical access to the system you suspect? If so, there is a question on the it security site about this. If you don't, then no. You would have to have some sort of Trojan that would call home (aka send email updates), but they won't always work on hard drives since it would have to run once plugged in.

1
  • yes i have access to to the suspected system please do give me any link related to this question Dec 16, 2012 at 17:47
0

Sorry to say, but the answer is no. Unlike smartphones today, hard drives don't have that option (yet). Only direct access to the computer your hard drive was connected to could show you what you are looking for, but there is no automatic online protection system for hard drives in that way.

2
  • i have access to the suspected system i guess if he had stolen it he would have connected it too. is there a way to find the drive's name or serial number that is connected to pc(i have access to the comuter) Dec 16, 2012 at 17:55
  • This is the question with similar result - link. If you have admin rights on that computer the answer in the link should help you.
    – sachiel6
    Dec 16, 2012 at 18:05
0

Find the serial number of your hard drive by requesting it at the store where you purchase your external hard drive, using your original receipt.

Most external hard drive enclosure require some kind of USB driver. Even so if this information itself is not enough, if the person did open any document from the external hard drive, there is some trace in the computer cache.

Circumstantial evidence can be gathered but this being said, 'investigating' someone else computer without is consent cannot server as evidence.

Not the answer you're looking for? Browse other questions tagged .