I want to know if a laptop or a desktop have been booted from an external device. Are there persistent BIOS logs or some other method to use for that purpose?
-
What OS are you using?– WildcardSep 6, 2019 at 18:14
-
The laptop is running Windows 10 pro– GiovaLombaSep 6, 2019 at 18:16
-
1Is the drive secured with Bitlocker or other encryption? Is your drive formatted using MBR/BIOS or UEFI/GPT? It would also be nice to know the make and model; please only get the model number from the serial number sticker, not anywhere else on the PC. Then, please click edit and put that info in your question, instead of using Add Comment.– K7AAYSep 6, 2019 at 18:21
-
The drives are not encrypted using Bitlocker or any other encryption method. And both use GPT. Even if I'm interested to know if my laptop has been booted with a live os from external media, the question is more broad and general. @K7AAY I prefere to not give haway maker, model or other details.– GiovaLombaSep 6, 2019 at 18:29
-
1This question is not off topic. It's about computer hardware, and isn't covered under the specified list of off-topics on superuser.com/help/on-topic– user1258361Sep 6, 2019 at 20:54
1 Answer
If your boot drive of a normal PC is formatted with UEFI/GPT, every time it is powered up a small file is rewritten, and the previous versions of that file are preserved. You can explore the BIOS/firmware with UEFItool to look for date and time stamps of those files.
You can learn if the drive is UEFI/GPT or MBR/BIOS in Windows with this app.
However, that depends on how standardized the BIOS is, for a manufacturer can use a custom BIOS which prevents this method, which is why I asked.
I do not know if there's an MBR/BIOS specific method.
-
The UEFITool require to have firmware images to work with. Do standard laptops ship with such images available for reading? How do I retrieve them? Sep 6, 2019 at 18:55
-
Every time it is booted during the testing and preparation process, an image is created and stored in the BIOS. Please refer to the instructions of UEFITool for more information.– K7AAYSep 6, 2019 at 20:36
-
I've read the all of the instructions given for that tool but they do not explain where and how to get those images you are talking of. Can you help with that? Sep 7, 2019 at 6:54