Someone took my sd card out of my phone and saved information on it that I didn't know about. Is there anyway to find out where my sd card was used last.
closed as off-topic by schroeder♦, Lucas Kauffman, Steve, TildalWave, Xander May 15 '15 at 12:41
This question appears to be off-topic. The users who voted to close gave this specific reason:
- "This question does not appear to be about Information security within the scope defined in the help center." – schroeder, Lucas Kauffman, Steve, Xander
Probably not. I'll elaborate.
FAT12/16/32 and probably NTFS, do not last I checked receive any marker from the system that mounted them as to what system used it last. This is likely also true with ext2/3/4, jfs, xfs, reiserfs, reiser4, ufs and btrfs.
ZFS keeps a fingerprint of the last system to use the pool, but that's more for preventing damage to the pool in case the pool was accidentally moved and may still theoretically still be "active" than for "Where the hell was I just now?" purposes.
Setting the filesystem itself aside, there is a possibility that what system created the files may be something that could be determined with forensic analysis, but depending on file type this is totally not guaranteed and methods exist to fraudulently modify said markers in files that provide them as a possibility. But, this is also not necessarily helpful because the files could have been passed from neutral device to neutral device countless times, without modification before finally arriving at your storage device.