I want to know if a laptop or a desktop have been booted from an external device. Are there persistent BIOS logs or some other method to use for that purpose?

  • What OS are you using? – Wildcard Sep 6 '19 at 18:14
  • The laptop is running Windows 10 pro – GiovaLomba Sep 6 '19 at 18:16
  • 1
    Is the drive secured with Bitlocker or other encryption? Is your drive formatted using MBR/BIOS or UEFI/GPT? It would also be nice to know the make and model; please only get the model number from the serial number sticker, not anywhere else on the PC. Then, please click edit and put that info in your question, instead of using Add Comment. – K7AAY Sep 6 '19 at 18:21
  • The drives are not encrypted using Bitlocker or any other encryption method. And both use GPT. Even if I'm interested to know if my laptop has been booted with a live os from external media, the question is more broad and general. @K7AAY I prefere to not give haway maker, model or other details. – GiovaLomba Sep 6 '19 at 18:29
  • 1
    This question is not off topic. It's about computer hardware, and isn't covered under the specified list of off-topics on superuser.com/help/on-topic – user1258361 Sep 6 '19 at 20:54

If your boot drive of a normal PC is formatted with UEFI/GPT, every time it is powered up a small file is rewritten, and the previous versions of that file are preserved. You can explore the BIOS/firmware with UEFItool to look for date and time stamps of those files.

You can learn if the drive is UEFI/GPT or MBR/BIOS in Windows with this app.

However, that depends on how standardized the BIOS is, for a manufacturer can use a custom BIOS which prevents this method, which is why I asked.

I do not know if there's an MBR/BIOS specific method.

  • The UEFITool require to have firmware images to work with. Do standard laptops ship with such images available for reading? How do I retrieve them? – GiovaLomba Sep 6 '19 at 18:55
  • Every time it is booted during the testing and preparation process, an image is created and stored in the BIOS. Please refer to the instructions of UEFITool for more information. – K7AAY Sep 6 '19 at 20:36
  • I've read the all of the instructions given for that tool but they do not explain where and how to get those images you are talking of. Can you help with that? – GiovaLomba Sep 7 '19 at 6:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.