12

How do I know what they found or viewed?

Improve this question
2
  • 6
    Confiscated by who? Makes a big difference.
    – Moab
    Jan 21, 2011 at 3:43
  • +1, Surprised no one has up voted this yet, it is a great question.
    – Moab
    Jan 21, 2011 at 3:45

3 Answers 3

Reset to default
13

If they did it the forensically correct way, then there is NO WAY to determine what was examined. The correct way would have been for the forensic tech to pull the hard drive out, clone it, return your hard drive to the machine and then examine the clone image. There will be no traces whatsoever on your drive since it was never booted. They will work strictly from the clone image and you should consider everything on the hard drive as having been compromised and you also should be aware they may have retained the image or parts of the image. Hope you didn't have anything on there you will regret.

Improve this answer
10
  • 1
    Indeed, you must assume they have seen everything. (Possibly including files you had deleted.) Just consider yourself lucky that they returned the system...
    – SamB
    Jan 21, 2011 at 3:18
  • 5
    Another reason for whole disc encryption using Trucrypt.
    – Moab
    Jan 21, 2011 at 3:44
  • 4
    As for the TrueCrypt, yes, it should help. But if the attacker is that dedicated, they may also plant a modified TrueCrypt bootloader that will save the entered password, then send it to their server. If they have time to disassemble your laptop, they may even plant a hardware keylogger. Be paranoid, be very paranoid
    – Martheen
    Jan 21, 2011 at 4:16
  • 2
    @typoknig : Pure bruteforce on a well implemented strong encryption would take years though. However, if there's weakness found later, the attack could made in shorter time period. As for now, I believe keylogging, hardware and or software, would be easier
    – Martheen
    Jan 21, 2011 at 4:59
  • 2
    @Martheen Cahya Paulo I agree it could take years, but it really depends on the encryption level. TrueCrypt allows up to 256 bit encryption I believe, which would take a very long time (years) to decrypt, but the encryption < 128 bit might only take weeks to months (basing this off of my experience with the AES encryption used in WiFi networks).
    – ubiquibacon
    Jan 21, 2011 at 5:08
2

You can use a script to recursively sort files on the system by last access time. However, with all of the activity constantly going on in the file system such as indexing, it is near impossible to determine exactly what they've looked at.

Improve this answer
2
  • 1
    Is or isn't near impossible?
    – Wuffers
    Jan 21, 2011 at 3:19
  • Is near impossible. My double negatives get the best of me sometimes :)
    – user1931
    Jan 21, 2011 at 3:29
0

The quickest way to view the time your files were last accessed, as far as I know:

  1. Download the search tool Everything: http://www.voidtools.com/

  2. Install it and run the program, and wait for it to index your disk (should take less than a minute)

  3. Richt-click on the column headers (where it says "date modified"), and enable "Last accessed"

  4. Now search for something random, like windows

  5. Click on the new column header "Last accessed" to sort search results, so that latest are on top

  6. Delete your old search, and search for *.*. This will take a long time, especially if this is the first time you use Everything; it could be up to 10 minutes, I don't know how long: that depends on your PC; just keep waiting, it took me 3 minutes on this old-ish PC

  7. Now you have a list of all the files on your PC, listed by the time they were last accessed, with dates and times.

Note that Windows also accesses some files when the PC is on without external output, so it you can't be sure it was they who accessed a file.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .