Can I find out when a hard disk was connected to a Windows system? [duplicate]

Possible Duplicate:
How to find out WHEN a usb disk was removed?

Recently someone stole my external hard drive. I suspect a friend of mine might have done that – I have access to his computer.

I have never given my hard drive to my friend. I guess Windows might register the hard drives that are connected to it, so is there a way to find out which hard drive is has been connected, the time it was connected (optional) to the Windows system, using either the hard drive's name or serial number?

6

3 Answers

Do you have physical access to the system you suspect? If so, there is a question on the it security site about this. If you don't, then no. You would have to have some sort of Trojan that would call home (aka send email updates), but they won't always work on hard drives since it would have to run once plugged in.

1

Sorry to say, but the answer is no. Unlike smartphones today, hard drives don't have that option (yet). Only direct access to the computer your hard drive was connected to could show you what you are looking for, but there is no automatic online protection system for hard drives in that way.

2

Find the serial number of your hard drive by requesting it at the store where you purchase your external hard drive, using your original receipt.

Most external hard drive enclosure require some kind of USB driver. Even so if this information itself is not enough, if the person did open any document from the external hard drive, there is some trace in the computer cache.

Circumstantial evidence can be gathered but this being said, 'investigating' someone else computer without is consent cannot server as evidence.