Question: Is there a method or a tool that can detect if someone has separated my hard disk from my computer, copied data from it, and returned it back?
I want to be sure that no one has done this without my knowledge, but I’m not sure how to this.
- Note:I use Deep freeze .
Answer: The use of deep freeze is irrelevant in this situation.
If they are semi competent, they will use a read only interface.
The last access timestamp will only be changed if they are using a read and write interface. Turning off the write interface is trivial. ?This is what forensics does. ?They never put an original drive in a read/write interface. ?Always in a read only. ?Then they make a working copy. ?All without altering a single bit on the original drive.
Your best bet is using a disk encryption like Bitlocker or TrueCrypt.
edit:
?
thanks alot, but could you clarify more what you mean by read and write interface please?
Devices like these . . .
They physically block write access to a drive. ?Often used in forensics/HD recovery for legal and practical reason, like the Amanda Knox case.