0

I have an external hard drive (usb) , I suspect that it might have been mounted into another computer on a precise date and time.

Is there any way to see the log (from the hdd) and verify if it was mounted in that precise moment or if any file was copied?

SDsolar
  • 3,089
  • 9
  • 27
  • 48
Doc Brown
  • 1
  • Do you have access to the other computer? – Rinzwind May 10 '18 at 15:58
  • 1
    https://askubuntu.com/questions/40471/where-can-i-find-the-log-files-for-mounting-disks see syslog. But you need access to the other computer. – Rinzwind May 10 '18 at 15:59
  • I don't have access to the other computer (might be a laptop). From the hdd, isn't it possible to see a log where it just says if on may 3rd between 1pm and 3pm the volume was mounted? – Doc Brown May 10 '18 at 16:07
  • Nope. Your system logs what happens on your system. Not what happens on another. So all you can prove is that the disk was or was not present in your computer at that time. Not if it was present in another. Files added to the system would have a timestamp that would fall outside the period the disk was present but there is no easy way to find that out. – Rinzwind May 10 '18 at 16:11
  • ok thank you. I thought the hdd had its own internal log. – Doc Brown May 10 '18 at 16:13
  • I apologize in advance for asking: should I open the terminal, writing the string that leads me to the mounted device and then type this: grep 'Mounted\|Unmounted' /var/log/syslog* – Doc Brown May 10 '18 at 16:40

1 Answers1

0

Simple answer is no.

The hard drive itself will not contain that information.

If you have access to the computer it was previously used with, then syslog will have recorded the plug/unplug events.

So you can know whether or not that drive was present on a particular computer.

SDsolar
  • 3,089
  • 9
  • 27
  • 48