4

is it possible to detect a boot-up via live CD (eg. Ubuntu, Debian, Tails ...) that happened in the past? If yes, where can this information be obtained?

I suspect my PC has been booted through a live CD, and got files manipulated,deleted ...

1
  • Depending on the filesystem of the target system (your PC), there might be ways to see filesystem changes, but it's far beyond my level of expertise to tell you how to check these or how long/detailed logs of filesystem changes are for various filesystems. The most pertinent question for that is probably "What type of file system does your system use? (NTFS, EXT3/4, etc)". That said, I think the real questions you should be asking are 'how do I recover from that happening?' and 'how do I prevent that in the future?' Mar 11, 2016 at 0:06

1 Answer 1

6

In general, it's possible for a live CD to boot a computer without leaving any traces. In some cases, this is an important feature of them - forensic imaging discs, for example, could change evidence if they wrote anything to the internal drives (and even then, professional forensic investigators usually copy using a hardware write-blocker if at all possible).

Therefore in this case, your best bet wouldn't be to look for evidence of booting from a live CD, but to look for evidence of changes to the filesystem which seem unexpected - files modified on a date that you were not using the computer (e.g. weekends, for an office PC), or at a time that the computer should have been off. You could also run an undeleter, and see if anything you don't expect to have been deleted shows up.

3
  • The timestamp idea is really intriguing. Anyone know if there is a tool out there to organize the file modification dates and present a calendar style list of when things were changed, to let the user better sift through what is truly a mountain of data? A Bayesian filter could be really useful, to automatically spot the files that were modified outside the normal use pattern. One simple approach would be to identify shutdown/startup based on OS logs and look for files that were changed outside those times.
    – Jeff Meden
    Mar 11, 2016 at 19:22
  • @JeffMeden Good idea - I'm not aware of any tools which automate this though. The place to look for that type of software might well be forensicswiki.org/wiki/Main_Page
    – Matthew
    Mar 11, 2016 at 19:45
  • @Matthew In general, this is a good idea. Does Windows OS "record" file modifications done by a third OS? Generally spoken, it's actually worst case to have not the hard-drive being highly encrypted. It's "just" my personal PC, but due to some very bad experience, I can't trust anyone. Thank you for your hint!
    – Shinzon
    Mar 13, 2016 at 19:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .