The internal HDD was removed from my laptop (with Windows 7) and connected to another machine to tamper with. Some new files were also created/copied by the mischief maker. After the tampering was done, the HDD was reconnected to my laptop.
I don't have access to the machine where the tampering was done. I only have access to the HDD. Is it possible to prove that the HDD tampered and files were created by an external machine, not the home machine?
Does NTFS file system logs or Windows log reveal something in such case?
P.S. I have to prove it using the contents of the HDD itself, hardware artifacts will not work.