Tom's Guide | Tom's Hardware | Tom's Games
 |
 |
 |
I am curious if anyone knows how, or software to read the S.M.A.R.T. on an external USB hard drive. I am trying to figure out the dates/times, amount of times that the hard drive was turned on. Any info would be helpful.
S.M.A.R.T. stands for Self-Monitoring Analysis and Reporting Technology. It has nothing to do with what you are looking for. Maybe there is something in the Event Viewer?
i_Xp/VistaUser
0 
Unfortunately this is a forensic analysis and the suspect wiped all information on the hard drive except the partition, so the event log does not help me there. I need to know when this hard drive was physically turned on.
0
The answer to your question may be elusive.
The only purpose of SMART is to detect and report on various indicators of reliability, in the hope of anticipating failures. It does not tell you anything else.
I suppose that if there was software installed on the machine that monitor user activities . . .
i_Xp/VistaUser
0
On the other hand if the suspect only deleted everything you can try professional recovery service. They should be able to recover what is recoverable. I think recovered files would show the timestamp last accessed or used.
Other than that there is no way you can determine when it was turned on and off and for how long for use as evidence in a criminal investigation.
i_Xp/VistaUser
0
if the partition has only been formatted then your suspect didn't care much about data recovery :)
tools to recover and restore the partion to it's full original beauty are plenty (e.g. TestDisk, Partition Recovery)
http://www.partition-recovery.com/
http://www.cgsecurity.org/wiki/Test...if you're just interested in the recovery of every single file, use WinHex (the time and date stamps of certain files can be evidence of when the computer has been used)
0
Thank you for your input, unfortunately, the data was securely wiped, making data recovery null. This was a last resort, and I have researched on S.M.A.R.T. reading software, however everything I am seeing shows that it only lets you read how the hard drive is functioning on a physical level (ie. no timestamps, etc). I appreciate your help.
0
I wish we are able to do better. The following link may interest you - it's about how a lawyer recovered external HD.
http://www.strozllc.com/casestudies...
i_Xp/VistaUser
0
Unless a disk is physically destroyed .... there is always some way to gather evidence. Depending on which team you are on: law enforcement or prosecution, you might be able to succeed if you invest enough resources.
At the federal jurisdiction level, the resources needed may not be as hard to solicit, but at the local level, this could easily be a herculian task.
Good luck!
0
"the sensitive client data and legal work had not been accessed."
i wonder how they can be assured?
sure you hook it up to a windows/linux machine, you'll be able to tell from certain time/date stamps. but what if you simply clone the drive from a console?
i know of various theft recovery and monitoring programs that can be stored in the HPA. however, this software must be installed by a security service vendor in the first place (of course companies dealing with confidential data are well advised to use such a service). you'll not find it on a hard drive you buy off the shelf.
anyway, the phrase "the sensitive client data and legal work had not been accessed." looks much better on a web blog than 'we can't be certain' :-P
0  |
 |
 |
This post is quite old and has been locked from receiving new replies. Please create a new posting instead.
| Ads by Google |
