0

The internal HDD was removed from my laptop (with Windows 7) and connected to another machine to tamper with. Some new files were also created/copied by the mischief maker. After the tampering was done, the HDD was reconnected to my laptop.

I don't have access to the machine where the tampering was done. I only have access to the HDD. Is it possible to prove that the HDD tampered and files were created by an external machine, not the home machine?

Does NTFS file system logs or Windows log reveal something in such case?

P.S. I have to prove it using the contents of the HDD itself, hardware artifacts will not work.

| improve this question | |
  • If you know the time it was done, you could just check timestamps – schroeder♦ Mar 28 '19 at 15:23
  • Depending on the type of file, and the OS that was used on the other machine, the metadata of the file might include the username – schroeder♦ Mar 28 '19 at 15:26
  • 2
    This sounds like a homework assignment for a forensics class – Crumblez Mar 28 '19 at 17:50
  • @schroeder Thanks for the edit in the post. Regarding the timestamps, the create dates of the files are anomalous, I have noted that. However, an offense is being accused based on the planted files, and the accuser is arguing that system time has been changed by myself at some point before the files were copied, which got reflected in the timestamps. Regarding the username information, I searched for it but could only find that NTFS filesystem does not store user information. Do you have some more information on that? – Gradient Mar 28 '19 at 21:19
1

As the attacker, it would be possible to modify the disk without leaving a trace. The attack does not need to use windows to mount NTFS, and could have specialised tools to not alter the metadata or provide fake metadata. The easiest way for an attacker to fake the meta-data would be to change the date-stamp on their machine.

That being said an attacker could be less sophisticated, or make a mistake that leaves traces on the drive. The simplest check for this is to look for files created/modified at a time you know you were away from your computer. This check is easily defeated.

To prevent this in the future use whole disk encryption, e.g. bitlocker.

| improve this answer | |
  • Thanks, the idea looks good. What do you mean when you said: "This check is easily defeated"? – Gradient Mar 31 '19 at 22:54
0

I would say, it is possible to prove that the HDD that you are talking about was tampered by some other machine and not yours but for that you should have deployed certain forensic tools beforehand which would have helped you out in this situation.

There are numerous tools such as S.M.A.R.T.,Second look, Belkasoft Acquisition, Bulk Extractor, etc.

As a part of precaution, experts always suggest to plan early when you are engaged with valuable data resources and you are responsible for maintaining the integrity of these resources.

If you want to perform forensic analysis on your HDD, first of all use a tool called dcfldd to create an image of the HDD and only then perform any kind of operations. This is to be done so that any existing evidence won't get tampered with.

It will be however a better idea to consult an expert in the field to handle your case and assist you through it in case if you are not from this field.

| improve this answer | |
  • 2
    This really doesn't answer the question. This is talking about all the things around actually figuring out what happened. – schroeder♦ Mar 28 '19 at 20:08
0

You can do all the other things mentioned here, if you need to, but most people just use one of the hard drive search programs available for free or in Windows itself. All you do is search by the date a file was modified or created.

https://www.voidtools.com/downloads/ Makes a program called Everything that literally searches everything. You go to View> Sort By > Date Modified, and you will see all your files listed by when they were modified.

In Windows File Explorer, you click the search bar then the search button at the top of the window then the date modified button.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.