I want to find out if someone has copied my personal details from my external hard disk. I don't care whether they read it, but it should not be copied to their system. So is there any method to find out if they copied it or not?


Yes, absolutely -- if you have some serious-player kind of forensic tools sitting around.

Otherwise, probably not. Depends on the filesystem in use. Some filesystems support "journalling" which could tell you if someone accessed it. Copying doesn't necessarily qualify as accessing, though. Again, depends on that drive's filesystem.

I'm guessing you have no awesome data forensics tools at your fingertips or you wouldn't even be asking this question, but you wanted to know whether any method exists, so I must answer "yes, absolutely" and "probably not".


If you loan out your disk to someone else and they attach the drive to their computer, the drive itself has no way of telling whether the file is viewed in an application, or copied. From the HD perspective both are read operations and are exactly the same thing.

If the files remained on your computer and were copied to an external media, there's various ways to turn on auditing on your computer to trace when a file is copied. But this relies on the files staying on your computer.


Think of it like this: if you give a piece of paper to someone for reading, can he create a copy of it or can you make sure he can only read it?

Even if the reader does not have access to a copy machine, he can still remember the contents, it just depends on the capability of his brain to memorize the position of characters. After that it only depends on his abilities to fake the document.

And here's the advantage or disadvantage of PCs (depends on the standpoint): they have huge brains in form of other hard disks.

  • Mr Thomas Weller its a 3500 line code – Mowbray Rv Sep 5 '15 at 6:58
  • 3500 lines are not a problem for a computer – Thomas Weller Sep 5 '15 at 7:38

It is theoretically possible to do that if you hack your HDD's firmware to log accesses to certain sectors to some unused space (either deterministically or at random). However, hacking firmware is pretty non-trivial, and is within capabilities of APTs (state-level or well-funded corporate/criminal teams). Most importantly, if you give out hardware to adversaries, all bets are off, and a dedicated person can do an inspection without triggering the log.

My advice would be simple: don't put sensitive data on hardware that you give to strangers/adversaries. Ever. Even if you try encryption, there may be unencrypted versions hanging around somewhere (swap file etc.)

  • Who knows if the reader does not extract the magnetic disk? – Thomas Weller Sep 5 '15 at 7:27
  • @ThomasWeller - that's what I wrote about an inspection without triggering the log. – Deer Hunter Sep 5 '15 at 7:42
  • The question said he doesn't care if the person reads the data, just that they shouldn't copy it. A fireware hack could not tell the difference between a read and a copy. – paj28 Sep 6 '15 at 11:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.