Does My Passport WD keep a history of downloads, transfers etc? In other words can user A detect user B's activity? Or can it just see the content of the storage unit?

  • 1
    Can you expand on the features of the unit? What model is it? Is it network connected or USB? – amccormack May 20 '15 at 21:53

It depends on the type of device

First and foremost, the kind of information you can recover depends on what kind of device and how that device is used. For instance, a USB attached drive has very different information than a NAS solution.

USB Attached Devices

USB Attached devices are treated as a typical disk. The forensic information you could recover from the disk could include access or write times, but a detailed log indicating who did what probably does not exist.

Network Attached Devices

If the device attaches over the network over WiFi or Ethernet, it may be using a webserver to serve the files. In the case of a webserver, there may be logging information that indicates if someone logged in and what files were downloaded. Whether or not you can get access to those logs (if they even exist) will depend on the device.

Some devices use SMB to share over the network. They also may log authentication details, but you may have to rely on filesystem forensics for information about when and what data was read.

If you can perform a packet capture against the network device, this will likely tell you what files were downloaded and by whom (assuming they have to log in or you can determine who a user is based on IP). However this is a step that has to be taken ahead of time.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.