External harddrive data transfer question

[thealias]

Hi everyone,

Not sure if this is the proper section to post this question in. Since I could not find security and it involves my harddrive, I chose storage.


I am wondering if an external harddrive has a hidden file or log that keeps track off all data transfers going in and out of it, including the names of the files.

I took my firewire drive to an office to work with someone on a project, and am not sure if I trust the woman that was using it in retrospect. I was not in the room with my drive the entire time and forgot I had sensitive files on it, and am thinking she could have easily and secretly copied them to her harddrive. Is there a way to check that from my drive?

If not, is it possible to check from her computer? A G5 or Mac pro tower running OSX 10.5 or 10.6, not exactly sure if it makes a difference.

Your advice is greatly appreciated!

Thanks.

 

[popatim]

you could look at the last time the file was accessed to help narrow it down but what stuff gets 'tracked' all depends on the drive format. For example fat32 keeps track of less items than ntfs does.

Also if you have sensitive files on a portable device and they are not encypted then you are... asking for trouble (to be polite)

 

[thealias]

Thanks for the reply.

The drive is formatted for Mac OS Extended (journaled), GUID. When you say "last time the file was accessed", do you mean check the 'date modified' organization option in a OSX Finder window, or some other more detailed way?

From what I believe, if a file is copied off of my external drive, the 'date modified' attribute would not change on the drive.

Appreciate the help.

 

[sminlal]

The NTFS file system used with Windows has a "date last accessed" timestamp that would have been updated if the file had been copied. Not sure about the Mac OS, though.

But the NTFS "date last accessed" timestamp can get updated by antivirus or backup programs that don't reset it to cover their tracks.

 

[thealias]

Just out of curiosity, and for those out there looking for this info, how would one find the "date last accessed" for the NTFS file system on Windows? Is it in a log?

 

[sminlal]

> how would one find the "date last accessed" for the NTFS file system on Windows?

Open Windows Explorer and navigate to the folder that holds the file in question.

Right-click the column headings and select "More..."

Scroll down to the "Date Accessed" item, click it so that it has a checkmark beside it, and click "OK".

 

[thealias]

much thnx.

 

[quatrow]

> how would one find the "date last accessed" for the NTFS file system on Windows?

Open Windows Explorer and navigate to the folder that holds the file in question.

Right-click the column headings and select "More..."

Scroll down to the "Date Accessed" item, click it so that it has a checkmark beside it, and click "OK".

Could we find a log somewhere about file trf from our pc to a specific external drive?