Sign in with
Sign up | Sign in
Your question

External harddrive data transfer question

Last response: in Storage
Share
December 22, 2010 7:33:46 PM

Hi everyone,

Not sure if this is the proper section to post this question in. Since I could not find security and it involves my harddrive, I chose storage.


I am wondering if an external harddrive has a hidden file or log that keeps track off all data transfers going in and out of it, including the names of the files.

I took my firewire drive to an office to work with someone on a project, and am not sure if I trust the woman that was using it in retrospect. I was not in the room with my drive the entire time and forgot I had sensitive files on it, and am thinking she could have easily and secretly copied them to her harddrive. Is there a way to check that from my drive?

If not, is it possible to check from her computer? A G5 or Mac pro tower running OSX 10.5 or 10.6, not exactly sure if it makes a difference.

Your advice is greatly appreciated!

Thanks.
a c 740 G Storage
December 22, 2010 10:53:20 PM

you could look at the last time the file was accessed to help narrow it down but what stuff gets 'tracked' all depends on the drive format. For example fat32 keeps track of less items than ntfs does.

Also if you have sensitive files on a portable device and they are not encypted then you are... asking for trouble (to be polite)
December 23, 2010 1:22:24 AM

Thanks for the reply.

The drive is formatted for Mac OS Extended (journaled), GUID. When you say "last time the file was accessed", do you mean check the 'date modified' organization option in a OSX Finder window, or some other more detailed way?

From what I believe, if a file is copied off of my external drive, the 'date modified' attribute would not change on the drive.

Appreciate the help.
Related resources
a c 415 G Storage
December 23, 2010 1:56:01 AM

The NTFS file system used with Windows has a "date last accessed" timestamp that would have been updated if the file had been copied. Not sure about the Mac OS, though.

But the NTFS "date last accessed" timestamp can get updated by antivirus or backup programs that don't reset it to cover their tracks.
December 23, 2010 2:16:37 AM

Just out of curiosity, and for those out there looking for this info, how would one find the "date last accessed" for the NTFS file system on Windows? Is it in a log?
a c 415 G Storage
December 23, 2010 4:52:14 AM

> how would one find the "date last accessed" for the NTFS file system on Windows?

Open Windows Explorer and navigate to the folder that holds the file in question.

Right-click the column headings and select "More..."

Scroll down to the "Date Accessed" item, click it so that it has a checkmark beside it, and click "OK".
December 23, 2010 10:20:19 AM

much thnx.
March 18, 2011 4:43:38 AM

sminlal said:
> how would one find the "date last accessed" for the NTFS file system on Windows?

Open Windows Explorer and navigate to the folder that holds the file in question.

Right-click the column headings and select "More..."

Scroll down to the "Date Accessed" item, click it so that it has a checkmark beside it, and click "OK".



Could we find a log somewhere about file trf from our pc to a specific external drive?
!