30

Is there a method or a tool that can detect if someone has separated my hard disk from my computer, copied data from it, and returned it back?

I want to be sure that no one has done this without my knowledge, but I'm not sure how to this.

  • Note:I use Deep freeze .
Improve this question
3
  • 10
    In the general case, someone who has physical access to a machine effectively owns the machine, Faronics' Deep Freeze or no. There are things you can do to make this harder but I seriously doubt it's possible to truly enforce.
    – Billy ONeal
    Commented Jul 18, 2011 at 14:09
  • 3
    Many commenters have mentioned that physical access pretty much means you're screwed. A related point: if you determine that someone has physically touched your drive, who cares about proof they've copied data? Assume they have.
    – Cascabel
    Commented Jul 19, 2011 at 5:19
  • 4
    I've always wondered this whenever someone sends in their laptop to Dell or HP. This is why I will never send my laptop into a warehouse with out first removing my hard drive.
    – James Mertz
    Commented Aug 14, 2011 at 1:48

10 Answers 10

Reset to default
50

The use of deep freeze is irrelevant in this situation.

If they are semi competent, they will use a read only interface.

The last access timestamp will only be changed if they are using a read and write interface. Turning off the write interface is trivial. This is what forensics does. They never put an original drive in a read/write interface. Always in a read only. Then they make a working copy. All without altering a single bit on the original drive.

Your best bet is using a disk encryption like Bitlocker or TrueCrypt.

edit:

thanks alot, but could you clarify more what you mean by read and write interface please??

Devices like these . . .

They physically block write access to a drive. Often used in forensics/HD recovery for legal and practical reason, like the Amanda Knox case.

Improve this answer
12
  • 10
    There are hardware devices that you can insert between a disk and a computer to block writes, to prove in court that the disk really wasn't tampered with.
    – MSalters
    Commented Jul 18, 2011 at 13:07
  • 10
    I can just connect the drive to my Linux computer and run dd if=/dev/sdx of=out.img. Afaik merely connecting the disk to a PC won't leave any traces. Then I'll get a copy of every byte on the disk that I can alter without you knowing, since I now have my own copy.
    – August Lilleaas
    Commented Jul 18, 2011 at 14:34
  • 4
    Interesting question raised by another answerer further down: Would these actions trigger the power-on time, power cycle count, etc SMART values to change - those are handled by the drive internally, yes, not the interface? (Obviously, you'd have to know the values in advance, which is unrealistic in the random-case, but still an interesting point)
    – DMA57361
    Commented Jul 18, 2011 at 18:59
  • 4
    @DMA57361: Yes, this will alter SMART attributes.
    – surfasb
    Commented Jul 18, 2011 at 19:07
  • 9
    Just an interesting note, SSDs have been giving some problems to forensics people. The firmware in the SSD will write all over the flash whenever it has power, regardless of if write commands are sent or not. Forex: if the last command received was a TRIM of everything, the SSD will busily zero blocks for future use even if it was immediately powered off.
    – Zan Lynx
    Commented Jul 18, 2011 at 19:58
36

Everyone seems to be going for full disc encryption, which certainly has its merits for securing your data but doesn't address the question of telling if someone's been in your machine and monkeying with your hard drive.

For that simple task, find a pack of the irritatingly sticky plain labels which, once stuck, tear instead of coming off cleanly, sign your name on it and stick it over one of the screws holding your hdd in place (don't forget to clean the dust off first for a good bond). Not quite on the same scale as the manufacturers tamper evident seals but should prove sufficient to prevent anyone removing the hard drive without your knowledge. This means they either have to break the label which alerts you to the fact, or pull the wires out of the hard drive then mount it on a laptop, forcing them to to spend more time with your case open looking very suspicious!

Also its worth checking the back of your pc for a padlock attachment point, simple, fairly secure and effective.

Neither makes it impossible to get at your data but both add a significant level of inconvenience and force the attacker to either act overtly (ripping labels and bolt cutters to the padlock) or spend a lot more time monkeying with your pc and at risk of detection.

Improve this answer
7
  • 1
    This is so cool method, and i will do that in the future , but what about now.is there any way to be sure if some one has copyied my data.(footprints).
    – Anyname Donotcare
    Commented Jul 18, 2011 at 11:57
  • 12
    Like surfasb said, unless your hypothetical intruder is dumb enough to write to the drive there is no reliable way to detect reading from it.
    – CarlF
    Commented Jul 18, 2011 at 12:23
  • 6
    In addition to what @CarlF said: If the intruder did write to it, then you should hope that you have not written to it since then, or it will become much harder to find any traces (harder or even impossible in some cases).
    – Joachim Sauer
    Commented Jul 18, 2011 at 12:53
  • 14
    Your sticker placement will be useless when somebody comes along with a cord and just plugs the drive into a disk reader without removing the drive from the machine or touching the screws! You need to secure the cable both to the drive and motherboard as well.
    – Caleb
    Commented Jul 18, 2011 at 13:16
  • 5
    @Robb: And pulling it apart with a screwdriver isn't obvious? In about an hour I could build a little disc duplicator using an embeded board of my desk that could be slipped into a machine and attached to the HD (and power) cables, left for a couple hours unnoticed, then retrieved. Physical access is inherently insecure if your data is not encrypted.
    – Caleb
    Commented Jul 18, 2011 at 14:23
30

To discover tampering at a physical level, you could use something like Torque Seal on your drive's mounting hardware or the data cable connection. It is a lacquer that dries brittle so any tampering will crack and break the glob you installed on the hardware. It's used to make sure things like nuts and bolts on helicopters haven't moved and are still torqued to spec.

Improve this answer
3
  • Cool solution (+1)! Every technician should have this in their toolkit! =P
    – Randolf Richardson
    Commented Jul 18, 2011 at 20:26
  • 1
    @Randolf Richardson: Nice, but since physical access controls I've seen were at the level of server room (doors are a somewhat mature technology, and thus access becomes much easier to handle - yes, key management is an obvious issue), this might be a nice defense in depth, but not a significant increase in security - a bit of an overkill, so to speak. For workstations - this requires eternal vigilance on the part of the user.
    – Piskvor left the building
    Commented Jul 19, 2011 at 10:29
  • @Piskvor: I was actually thinking along the lines of this solution being far less valuable if every technician had it in their toolkit (and wondering if a security-minded person might pick up on that, but perhaps I was way too subtle -- my fault, sorry), hence the emoticon of the tongue sticking out. +1 for you for pointing out some important information though.
    – Randolf Richardson
    Commented Jul 19, 2011 at 20:26
25

S.M.A.R.T. attributes may help in determining if the disk has been tampered with between two intervals. These attributes, on Linux, can be queried with "smartctl -a /dev/sda".

The simplest attribute for that is probably Power_Cycle_Count. When you power up the computer, this will be one more than the value when it was last shut down. So, by remembering this value before you shut down, and checking it when you power up next time, you can determine if the disk has been powered up in between.

Improve this answer
4
  • 2
    This needs to be anticipated. You cannot ask the drive back in time.
    – Thorbjørn Ravn Andersen
    Commented Jul 18, 2011 at 16:26
  • 5
    This is an internal write, where the disk keeps state of operation regardless of whether an actual write interface has been enabled (i.e. even in read-only mode) -- I think this is pretty smart way, but it needs the additional step of storing power cycle counts for disk off-box
    – Soren
    Commented Jul 18, 2011 at 16:43
  • An intruder who is familiar the low-level aspects of S.M.A.R.T. technology may be able to tamper with the internal counters. I'm assuming this is very unlikely though.
    – Randolf Richardson
    Commented Jul 18, 2011 at 20:24
  • 3
    It is very very hard to modify S.M.A.R.T. counters. Most of the time this will involve a new hard drive firmware code load. Even then, only a few of the counters reset (by demand of certain large hard drive purchasers). If you have the relevant counter that you can interpret correctly, this will tell you how many times the drive has been powered/spun up. S.M.A.R.T. will increment the POWER_CYCLE_COUNT even in cases where you power the drive and don't connect anything on the interface, at least in all sane implementations.
    – user11934
    Commented Jul 18, 2011 at 21:40
12

Just a thought..maybe S.M.A.R.T.(if available) contains some information that can be used.

Improve this answer
1
  • 1
    +1, this was my line of thought also.
    – Sirex
    Commented Jul 18, 2011 at 13:44
7

I'm pessimistic about prevention from reading the drive, and telling, if somebody did, so I would advice to use encryption too. You still don't know whether somebody did copy the encrypted data, but if he did, it is hard to break (hope so).

Now is the attacker clever, informed, does he have time, equipment and money? A simple trick, which will not work, if the bad guy is reading here, would be to stick a hair, which is hard to see, and easy to break, to your drive and the chassis, best: across the data cable.

Now if somebody removes the drive, he will break the hair without mentioning it. Except he read this advice, and acts very carefully.

If he is very well equiped, but you are too, you can take a hair which you perform a DNA-test on. You don't say whoms hair it is. The intruder might replace the hair with a random one, but can't replace it with a hair of the right DNA. But maybe he knows how to glue a broken hair together? Or he knows how to dissolve the glue? :)

Improve this answer
1
  • +1 for "splitting hairs." ;-D Placing the hair back in its original position, although broken, can still be a point of confusion for the original owner since they may then wonder if they inadvertently broke the hair, but your explanation covers the issues very nicely.
    – Randolf Richardson
    Commented Jul 18, 2011 at 20:19
6

Unless you can remember exactly how things were placed within your computer prior to the suspected intrusion (a photographic memory, or a photograph, are two such tools that immediately come to mind), it will be very difficult to know if your hard drive was removed from your computer.

Note: Chassis intrusion features can usually be circumvented, so this may not be the most reliable method either although it can be helpful.

Chances are that an intruder who knows how to do this may also be smart enough not to modify your disk in any way, and either just copy only the files they want/need, or copy the disk in its entirety so they can "snoop around" at their leisure at some later time.

The bottom line is that if you're truly concerned about someone accessing your hard drive, you have to be preventive. If physically removing your computer away from the danger is not a viable option, then encryption works very well; this is my favourite disk encryption tool:

  TrueCrypt (free and open source)
  http://www.truecrypt.org/

What I particularly like about this tool is that there's no built-in backdoor, so even a court order won't get it decrypted if you've taken the right steps to protect the encryption key.

How this tool is relevant to your situation:

If your hard drive is encrypted, and the intruder removes it from your computer for the purpose of accessing your data, they will only find encrypted data (and, initially, the Operating System will most likely detect it as an "uninitialized disk") that simply looks like random information to just about everyone.

The two ways the intruder may gain access to your data is:

  1. A "lucky guess" at your password (so pick a good one that's difficult to guess, even with a brute force attacking tool) or key (highly unlikely, although not completely impossible)

  2. You provided a copy of your password or key to the intruder (intentionally or unintentionally)

Improve this answer
1
6

With your average home computer (no special physical security), when the machine is shutdown, there is no trace left of activities done with the hardware.

If the disk is removed and mounted read-only, it would be very difficult to identify this was done using any software.

The only thing that comes to mind is, if the disk was writeable during such an activity, and the host OS ended up updating timestamps on the disk (files, directories) you might be able to detect that the disk was physically accessed outside your system. This comes with various other caveats like, the other system also had its time set correctly (a reasonable expectation if the user did not think of a read-only mount) and you know the time-window when your system was expected to be powered-down (hence, access times in that window are suspect).

For such data to be usable, you must mount the disk without write access while your 'forensics' is not done. You might then be able to read the access times of individual files and directories to identify what was looked at (read or copied out).

Now, if this is for a future possibility of data-theft, it would be tons easier to plan ahead -- just encrypt all your critical data.

Improve this answer
5
  • Do you mean that , if the windows time has changed ,this means that some one may separate my hard disk..
    – Anyname Donotcare
    Commented Jul 18, 2011 at 7:34
  • 2
    No, it means that the last accessed timestamp of a file would be updated if it was accessed. Also, other files may potentially be created, modified, or deleted by the operating system when they install it in another system. Of course if someone is going to the trouble of sneaking the drive out and installing it in another system to steal data, they’ll probably be avoiding these issues.
    – Synetech
    Commented Jul 18, 2011 at 7:39
  • i use deep freeze application is this change those factors?and from three days i found my windows clock has changed , is this may related to coping my data?
    – Anyname Donotcare
    Commented Jul 18, 2011 at 7:42
  • note: my hard disk is not an external hard disk.
    – Anyname Donotcare
    Commented Jul 18, 2011 at 7:49
  • 9
    The last accessed timestamp will not change if they are using a custom file system driver or a read only interface, both which are likely. Deep freeze will not change a thing. They teach you in IT security that "If malicious people have physical access to your computer, it is no longer your computer."
    – surfasb
    Commented Jul 18, 2011 at 8:13
3

Are we not we simply skirting the real issue here?

Like a new born child, we should NEVER leave our PC alone in an open accessible area! Where is your notebook now? Security starts with us and not after the fact.

Personal data comes with a degree of paranoia. If you leave it on your system then you are afraid that it may be stolen. If your data is that critical, then, as soon as you create/acquire it, remove it to a secure storage device, aka an encrypted SD flash device. This device can then be with you at all times.

Current computer technology will not detect the tampering of the data on a physical storage device. It is this lack of security that permits PC technicians like my self to salvage user data in the event of virus/malware damage. When in the future storage devices are embedded with a running security program, then the device itself will know when it has been tampered with.

Simply take responsibly for your data! If you permit someone access, then you cannot complain if it is exploited!

As a direct answer to the posted question; as of today, NO, it is not possible to determine if someone has removed and simply copied your files.

Thank you all for listening.

Improve this answer
2

Many new computers allow password-protecting the hard drive itself. It would be a BIOS setting. The protection is enforced through the drive's electronics, so access would be denied on another machine.

Keep in mind that encryption, though a good idea if you need to do it, also would prevent you from being able to recover from many computer problems. And if the hard drive started to fail, you could never recover your files from an encrypted disk. So make sure that you have good backups. And a disk image of an encrypted disk is still encrypted and can be restored to a new drive if necessary.

Windows built-in EFS (Encrypting File System) can be used for individual files and folders. And the free Windows BitLocker encryption tool can encrypt a whole drive.

Improve this answer
10
  • That's wrong -- with TrueCrypt a recovery CD is generated at the time of encryption, and the drive can be mounted by TrueCrypt installed from another computer (as long as the correct password/key is used). TrueCrypt, in fact, can encrypt specific partitions or an entire hard drive (encompassing all partitions).
    – Randolf Richardson
    Commented Jul 18, 2011 at 18:29
  • 1
    I'm not comfortable using BitLocker because it's not open source (TrueCrypt is open source), and so I have no reliable way of knowing for certain if a "backdoor feature" is present. Here's an interesting article about a hacking toolkit from Microsoft (intended for law enforcement; I wonder if it's already on Pirate Bay?) that also touches on BitLocker: betanews.com/article/…
    – Randolf Richardson
    Commented Jul 18, 2011 at 18:33
  • @Randolf: I think Abraxas is speaking of the BIOS encryption. However, I think that if the BIOS supports the drive encryption commands at all, a BIOS on another computer will decrypt the drive also as long as you provide the identical BIOS password.
    – Zan Lynx
    Commented Jul 18, 2011 at 20:02
  • @Zan Lynx: The first paragraph is about password protection, the second paragraph is about data encryption, and the third paragraph suggests the use of two proprietary data encryption products as possible solutions. I responded to the points about data encryption, which are, essentially, responses to the second and third paragraphs.
    – Randolf Richardson
    Commented Jul 18, 2011 at 20:17
  • 1
    @Zan Lynx: That wasn't obvious to me (maybe they should have been combined as a single paragraph then, or the phrase "password-based encryption" should have been used instead of "password-protecting?"). Please also note that I do agree with your first comment about a BIOS on another computer decrypting the drive (obviously using the same brand/version or a compatible BIOS will be an important factor).
    – Randolf Richardson
    Commented Jul 18, 2011 at 20:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .