1

Someone took my sd card out of my phone and saved information on it that I didn't know about. Is there anyway to find out where my sd card was used last.

3
  • Can't you just see the date for when the file was created? Most of systems and files provide you that info
    – Freedo
    Commented May 13, 2015 at 0:19
  • @Freedom The question here is where not when. And it's generally unlikely that the card will store that info itself. Metadata in the files might help though.
    – Iszi
    Commented May 14, 2015 at 20:05
  • I think your guys are just thinking too much technologically... SD cards can be used in cameras/laptops/phones and i doubt anyone used a camera to do forensics...while you can do some things with phones it's more probable someone used a laptop for it...and this come down to linux or windows or mac only
    – Freedo
    Commented May 15, 2015 at 16:09

1 Answer 1

4

Probably not. I'll elaborate.

FAT12/16/32 and probably NTFS, do not last I checked receive any marker from the system that mounted them as to what system used it last. This is likely also true with ext2/3/4, jfs, xfs, reiserfs, reiser4, ufs and btrfs.

ZFS keeps a fingerprint of the last system to use the pool, but that's more for preventing damage to the pool in case the pool was accidentally moved and may still theoretically still be "active" than for "Where the hell was I just now?" purposes.

Setting the filesystem itself aside, there is a possibility that what system created the files may be something that could be determined with forensic analysis, but depending on file type this is totally not guaranteed and methods exist to fraudulently modify said markers in files that provide them as a possibility. But, this is also not necessarily helpful because the files could have been passed from neutral device to neutral device countless times, without modification before finally arriving at your storage device.

2
  • Thanks very much for the help. The information on it wasn't exactly what I wanted to share or ask anyone I know about so great help. Thanks again. Commented May 12, 2015 at 19:41
  • @BeccaWhitted There is a chance that the data that was placed on the card could be forensically analyzed to figure out where it was created, but that may not help whatsoever with what devices held the data between the source and your card.
    – killermist
    Commented May 12, 2015 at 19:51

Not the answer you're looking for? Browse other questions tagged .