An ex-girlfriend has demonstrated an ongoing ability to access files stored only on my Windows 10 x64 PCs and Microsoft OneDrive. How can I find or trace the mechanism by which she is doing this? Details:
- Months ago, before we broke up, she had both unsupervised physical access to one of the PCs and admin access before I password protected my single user account. (Nobody has since had physical access to the PC when I was logged in.)
- I have changed the password to my Microsoft account that includes OneDrive, but she has subsequently demonstrated access to new files. So this is not a simple matter of password compromise.
- She is not exceptionally technically savvy, but she knows people who are. Those people have never had physical access to my devices.
- I have done a complete physical inspection of the device to which she once had access. There are no evident appendages or modifications to the hardware. (And she is not skilled enough to confidently open computer case, much less place a covert hardware backdoor.)
Given this background, I imagine the most likely vector is an "exploit in-a-box" she was provided and able to install on the PC. However I have assumed that Windows Defender would detect those because they are well known. Is this a bad assumption? What else should I use to scan for known backdoors?
It is possible that she has enlisted a reasonably skilled hacker who is using known exploits to occasionally access either OneDrive or the PC's drive data.
I would prefer to sniff out the intrusion mechanism, or at least some evidence of when and whence intrusions have occurred, before blindly locking down the system.