3

I have a situation in which a person has been accessing confidential information from another PC which they shouldn't have accessed and stored the acquired information on their own PC.

Since all of the computers are within my jurisdiction, I am the one responsible for any information leaks and, since I don't know whether that person is going to misuse the information, I could copy/clone/seize their hard drive to serve as a proof that they stole and had that info on their PC should they try to e.g. sell that info to competition.

What I'm interested in: if the information ends up in competition's hands, I will know for certain they did it but can I prove it by showing that the original drive was inside their PC? Are there traces that could link that hard drive to his PC e.g. motherboard/CPU configuration, user name etc. or would that be dismissed under argument that I could've written that info to the disk?

Improve this question
10
  • I presume you want to confirm the HDD was installed in a computer assigned to you, and both are assets, inventoried by you? You should have record that they were assigned the computer, simply taking note of the serial of the HDD inside that computer currently, should do the trick. Most programs like Speccy will provide you the serial number of the HDD, they will also indicate the license for Windows, both should be something that is part of your inventory information. When an employee is assigned a computer, you make them sign a document that they received the computer, which includes the HDD
    – Ramhound
    Mar 16, 2016 at 18:04
  • You are on the point but I want it to be undisputable whether I have tampered with the disk. They could for example say that I put the disk in another PC and written to it. Could I seize the PC and have undeniable proof that the HDD was written to only by their PC?
    – user571607
    Mar 16, 2016 at 18:44
  • You inventory the hardware in the PC. You then have the employee sign the inventory slip. You do this for every employee, or just them, they can't argue at that point. Once signed, seize the hardware, and make a byte-to-byte copy of the HDD. What other things you can do, seek the advice of a lawyer, I am hesitant to go into deeper detail for that reason.
    – Ramhound
    Mar 16, 2016 at 18:47
  • 1
    You should seek the advice of a lawyer.
    – Ramhound
    Mar 16, 2016 at 19:00
  • 1
    "I will know for certain they did it" - you dont know anything other than the competition has the files. Saying someone stole data without real evidence is slander.
    – Keltari
    Mar 17, 2016 at 0:21

1 Answer 1

Reset to default
1

It can't really be proven, sorry.

When a hard drive is connected to a computer as a data drive, nothing is going to be written to it unless the user explicitly puts something there. Even if the user did write to it, no file system I'm aware of records any sort of hardware-specific information in the change journals.

If the computer booted the drive, things are slightly different. (Windows-specific information up ahead.) Driver installations are logged, but then you'd only be able to guess what kind of machine the drive was in based on what drivers and PnP IDs were in play. It is conceivable that Windows troubleshooting/telemetry programs recorded hardware-specific data and wrote them to disk, but there's no way to prove that they're accurate. After all, you could have faked the on-disk data (or fiddled with the data collector, if you're clever).

Even things that might seem to contain machine-specific information (like some places in the Registry) really only contain information specific to the OS installation. The machine SID is a good example of such data.

You could write a program that, on machine startup, records a lot of information like motherboard serial number and MAC address, but again, even if you're convinced the drive was there, you can't without-a-doubt prove that the collected data is real.

Improve this answer
1
  • 1
    It isn't hard to prove a drive was in a machine, you just have to track the serial number of the HDD, to the serial number of the machine. If you did this for all your machines, then you would know, where every single one of your HDDs were. Of course this can't prove a file came from HDD A though, unless you totally change how you protect your files, and digitally sign each copy of them with unique information tied to the user accessing it. Everything stated in this answer is also correct though.
    – Ramhound
    Mar 17, 2016 at 2:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy