Recently left my flash drive on the university computers and someone found it. He said he looked through the flash drive to find my resume and contact me. I want to leave this situation in good faith, but I was wondering if it is possible to find out when files were added to the flash drive.

I initially thought you could just look at date modified, but for my intent, that won't help me.

Note: my flash drive is big enough to not be able to find any file I don't recognize.

  • Which file system does the flash drive use? – CodesInChaos Apr 7 '17 at 8:22
  • If you use a journaled filesystem (including NTFS naively changing files will likely leave traces in the log. Unfortunately flash drives typically use some FAT flavour. – CodesInChaos Apr 7 '17 at 8:28
  • It could be a ruber-duck. You never can trust anything. How much you trust it depends on where you use it, and what it has on it, and if you have backups (or file hashes) else where. – ctrl-alt-delor Apr 11 '17 at 21:56

No. The flash drive itself does not have its own concept of time and has to rely on the time being given to it by the host computer. This link has good information on how to detect some date forgery but a sufficiently skilled attacker would be able to plan for this (Note: the link refers specifically to NTFS, so if your flash drive is a different format your mileage may vary).

If you believe the device could have been tampered with the absolute safest thing to do is either format your existing one, or throw it away and get a new one.

  • 1
    That articles weird, i would have thought the most common way to forge a time stamp is to set the whole computers clock back and then copy the document. But it makes no mention of this method. – daniel Apr 7 '17 at 7:06

No, not now, if you have a backup of the data on the USB stick you could compare the two and see any differences but if you had a backup you could just toss the USB stick. If you had encrypted part of the drive before it was misplaced then you could be sure that part was not modified or exposed. But even then after having it returned you would want to copy the encrypted file off and throw it away if you were paranoid.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.