Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

is there any way to know if the file I have on my mini-SD card was moved or copied to my PC?

i have sensitive files on my SD card which is stolen and i cant remember if I cut or copied the file from my SD card to my PC. All I know is that I have backed-up the file to my PC. I have the file now. How do I know if I deleted it from my SD card (moved/cut). Thanks.

Im using windows 8 btw.

share|improve this question

closed as off-topic by Terry Chia, Xander, NULLZ, Noordung, dr jimbob Aug 11 '13 at 1:50

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions about general computing hardware and software are off-topic here, but can be asked on Super User." – Xander, NULLZ, Noordung, dr jimbob
If this question can be reworded to fit the rules in the help center, please edit the question.

2 Answers 2

There is no way of knowing. When storing sensitive data you should securely encrypt them before storing them on an external medium.

Even if you had cut them off, the files will still reside on the device and will still be recoverable unless you have securely wiped them off the drive using a file shredder. Most file systems just allocate the space as free but the bits containing the actual data will still be on the device.

share|improve this answer
    
Thanks for your comment. I know that files can still be recovered if the file block is not yet overwritten by some other file or by not using the file shredder. But the person who i suspect stole my SD card is not an IT expert nor, has any basic knowledge about computer. I just want to know if the file is theoretically not in the windows explorer list once he views my SD card on his computer.. –  user29353 Aug 10 '13 at 4:18

There is no way to know for sure, but you can get an idea from the dates of the files on your PC. See this article from Microsoft. Basically, the created data is fresh with a copy, but a move carries the previous created date. Of course, this is also assuming that by using the term PC you are using Windows. If you used Linux (or something else), I wouldn't count on this behavior.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.