Can I find out when a hard disk was connected to a Windows system?

Possible Duplicate:
How to find out WHEN a usb disk was removed?

Recently someone stole my external hard drive. I suspect a friend of mine might have done that – I have access to his computer.

I have never given my hard drive to my friend. I guess Windows might register the hard drives that are connected to it, so is there a way to find out which hard drive is has been connected, the time it was connected (optional) to the Windows system, using either the hard drive's name or serial number?

abhinav kumar

Posted 2012-12-16T17:23:51.470

Reputation: 1

3Did you really write "friend"? – Xavierjazz – 2012-12-16T19:57:17.903

Instead of trying to snoop in their registry, just take the whole system hostage until they give your drive back. – Synetech – 2012-12-17T06:44:43.707

@Synetech And wind up being arrested for breaching a variety of unauthorised access laws? Two wrongs don't make a right. Theft is illegal, go to the cops instead of trying to be a vigilante. – Polynomial – 2012-12-17T10:43:09.077

I guess if you got it back you could try and recover deleted files from it - this would then give you an indication if all the deleted files were your old files! – Dave – 2012-12-17T11:37:43.310

@Polynomial, hole cow, calm down. I was being faceicious (and I don’t see you freaking out about the idea of snooping in someone else’s computer, which is also illegal). I think you have misunderstood the issue. If his friend really did take his drive, then he isn’t in a position to complain. Also, you may be envisioning some corporate scenario while it is more likely to be roommates or buddies, so they are not enemies across town; it would be easier to take the system hostage by locking himself in his friends room than actually taking it—and thus take all of his friends stuff hostage. – Synetech – 2012-12-17T15:48:13.367

@Synetech Relax, I wasn't freaking out. Keep in mind I spend 99% of my time on StackExchange over at the IT Security boards, so we get a lot of this stuff come through. I didn't mention the access to the friend's computer because I assumed he meant legit access (e.g. when round his house) - if he still considers someone who stole from him a friend then it's clearly already a strange relationship. Anyway, the best solution is to go to the cops and get them to recover the equipment, rather than choosing a method that might only potentially get him his hard disk back. – Polynomial – 2012-12-17T15:55:59.217

Answers

Do you have physical access to the system you suspect? If so, there is a question on the it security site about this. If you don't, then no. You would have to have some sort of Trojan that would call home (aka send email updates), but they won't always work on hard drives since it would have to run once plugged in.

Canadian Luke

Posted 2012-12-16T17:23:51.470

Reputation: 22 162

yes i have access to to the suspected system please do give me any link related to this question – abhinav kumar – 2012-12-16T17:47:56.473

Sorry to say, but the answer is no. Unlike smartphones today, hard drives don't have that option (yet). Only direct access to the computer your hard drive was connected to could show you what you are looking for, but there is no automatic online protection system for hard drives in that way.

sachiel6

Posted 2012-12-16T17:23:51.470

Reputation: 51

i have access to the suspected system i guess if he had stolen it he would have connected it too. is there a way to find the drive's name or serial number that is connected to pc(i have access to the comuter) – abhinav kumar – 2012-12-16T17:55:49.223

This is the question with similar result - link. If you have admin rights on that computer the answer in the link should help you.

– sachiel6 – 2012-12-16T18:05:51.497

Find the serial number of your hard drive by requesting it at the store where you purchase your external hard drive, using your original receipt.

Most external hard drive enclosure require some kind of USB driver. Even so if this information itself is not enough, if the person did open any document from the external hard drive, there is some trace in the computer cache.

Circumstantial evidence can be gathered but this being said, 'investigating' someone else computer without is consent cannot server as evidence.

happy

Posted 2012-12-16T17:23:51.470

Reputation: 101