Recently left my flash drive on the university computers and someone found it. He said he looked through the flash drive to find my resume and contact me. I want to leave this situation in good faith, but I was wondering if it is possible to find out when files were added to the flash drive.
I initially thought you could just look at date modified, but for my intent, that won't help me.
Note: my flash drive is big enough to not be able to find any file I don't recognize.
No. The flash drive itself does not have its own concept of time and has to rely on the time being given to it by the host computer. This link has good information on how to detect some date forgery but a sufficiently skilled attacker would be able to plan for this (Note: the link refers specifically to NTFS, so if your flash drive is a different format your mileage may vary).
If you believe the device could have been tampered with the absolute safest thing to do is either format your existing one, or throw it away and get a new one.
No, not now, if you have a backup of the data on the USB stick you could compare the two and see any differences but if you had a backup you could just toss the USB stick. If you had encrypted part of the drive before it was misplaced then you could be sure that part was not modified or exposed. But even then after having it returned you would want to copy the encrypted file off and throw it away if you were paranoid.
