Does My Passport WD keep a history of downloads, transfers etc? In other words can user A detect user B's activity? Or can it just see the content of the storage unit?
closed as off-topic by Mark, schroeder♦, Stephane, Rory Alsop♦ May 22 '15 at 9:45
This question appears to be off-topic. The users who voted to close gave this specific reason:
- "This question does not appear to be about Information security within the scope defined in the help center." – schroeder, Stephane, Rory Alsop
It depends on the type of device
First and foremost, the kind of information you can recover depends on what kind of device and how that device is used. For instance, a USB attached drive has very different information than a NAS solution.
USB Attached Devices
USB Attached devices are treated as a typical disk. The forensic information you could recover from the disk could include access or write times, but a detailed log indicating who did what probably does not exist.
Network Attached Devices
If the device attaches over the network over WiFi or Ethernet, it may be using a webserver to serve the files. In the case of a webserver, there may be logging information that indicates if someone logged in and what files were downloaded. Whether or not you can get access to those logs (if they even exist) will depend on the device.
Some devices use SMB to share over the network. They also may log authentication details, but you may have to rely on filesystem forensics for information about when and what data was read.
If you can perform a packet capture against the network device, this will likely tell you what files were downloaded and by whom (assuming they have to log in or you can determine who a user is based on IP). However this is a step that has to be taken ahead of time.