1

Someone took my sd card out of my phone and saved information on it that I didn't know about. Is there anyway to find out where my sd card was used last.

closed as off-topic by schroeder, Lucas Kauffman, Steve, TildalWave, Xander May 15 '15 at 12:41

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "This question does not appear to be about Information security within the scope defined in the help center." – schroeder, Lucas Kauffman, Steve, Xander
If this question can be reworded to fit the rules in the help center, please edit the question.

  • Can't you just see the date for when the file was created? Most of systems and files provide you that info – Freedo May 13 '15 at 0:19
  • @Freedom The question here is where not when. And it's generally unlikely that the card will store that info itself. Metadata in the files might help though. – Iszi May 14 '15 at 20:05
  • I think your guys are just thinking too much technologically... SD cards can be used in cameras/laptops/phones and i doubt anyone used a camera to do forensics...while you can do some things with phones it's more probable someone used a laptop for it...and this come down to linux or windows or mac only – Freedo May 15 '15 at 16:09
4

Probably not. I'll elaborate.

FAT12/16/32 and probably NTFS, do not last I checked receive any marker from the system that mounted them as to what system used it last. This is likely also true with ext2/3/4, jfs, xfs, reiserfs, reiser4, ufs and btrfs.

ZFS keeps a fingerprint of the last system to use the pool, but that's more for preventing damage to the pool in case the pool was accidentally moved and may still theoretically still be "active" than for "Where the hell was I just now?" purposes.

Setting the filesystem itself aside, there is a possibility that what system created the files may be something that could be determined with forensic analysis, but depending on file type this is totally not guaranteed and methods exist to fraudulently modify said markers in files that provide them as a possibility. But, this is also not necessarily helpful because the files could have been passed from neutral device to neutral device countless times, without modification before finally arriving at your storage device.

  • Thanks very much for the help. The information on it wasn't exactly what I wanted to share or ask anyone I know about so great help. Thanks again. – Becca Whitted May 12 '15 at 19:41
  • @BeccaWhitted There is a chance that the data that was placed on the card could be forensically analyzed to figure out where it was created, but that may not help whatsoever with what devices held the data between the source and your card. – killermist May 12 '15 at 19:51

Not the answer you're looking for? Browse other questions tagged or ask your own question.