5

I want to know if a laptop or a desktop have been booted from an external device. Are there persistent BIOS logs or some other method to use for that purpose?

6
  • What OS are you using?
    – Wildcard
    Sep 6, 2019 at 18:14
  • The laptop is running Windows 10 pro
    – GiovaLomba
    Sep 6, 2019 at 18:16
  • 1
    Is the drive secured with Bitlocker or other encryption? Is your drive formatted using MBR/BIOS or UEFI/GPT? It would also be nice to know the make and model; please only get the model number from the serial number sticker, not anywhere else on the PC. Then, please click edit and put that info in your question, instead of using Add Comment.
    – K7AAY
    Sep 6, 2019 at 18:21
  • The drives are not encrypted using Bitlocker or any other encryption method. And both use GPT. Even if I'm interested to know if my laptop has been booted with a live os from external media, the question is more broad and general. @K7AAY I prefere to not give haway maker, model or other details.
    – GiovaLomba
    Sep 6, 2019 at 18:29
  • 1
    This question is not off topic. It's about computer hardware, and isn't covered under the specified list of off-topics on superuser.com/help/on-topic Sep 6, 2019 at 20:54

1 Answer 1

2

If your boot drive of a normal PC is formatted with UEFI/GPT, every time it is powered up a small file is rewritten, and the previous versions of that file are preserved. You can explore the BIOS/firmware with UEFItool to look for date and time stamps of those files.

You can learn if the drive is UEFI/GPT or MBR/BIOS in Windows with this app.

However, that depends on how standardized the BIOS is, for a manufacturer can use a custom BIOS which prevents this method, which is why I asked.

I do not know if there's an MBR/BIOS specific method.

3
  • The UEFITool require to have firmware images to work with. Do standard laptops ship with such images available for reading? How do I retrieve them?
    – GiovaLomba
    Sep 6, 2019 at 18:55
  • Every time it is booted during the testing and preparation process, an image is created and stored in the BIOS. Please refer to the instructions of UEFITool for more information.
    – K7AAY
    Sep 6, 2019 at 20:36
  • I've read the all of the instructions given for that tool but they do not explain where and how to get those images you are talking of. Can you help with that?
    – GiovaLomba
    Sep 7, 2019 at 6:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .