> Let me clear up a little bit on my Q.
>
> no i was worrying about a theft, someone more smarter! Like what if he mounts the disk as read only (write blocker?) & creates a bit-to-bit dump of the hdd for later inspection. In this situation what are the other evidence left on the CHIPS/MEMORY of hdd itself helpful for a forensic examiner!? The only other thing i can think of was if the OS the hdd had... had run a SMART monitoring tool that keeps a fresh LOG of SMART status of the hdd @ every shut-down of the PC (as say shutdown script) examining the "power on time" (in hrs) before & after the theft maybe the only clue i can think of!
>
> WHAT ELSE ARE OTHER THINGS LEFT TO LOOK FOR IN THIS SITUATION?
Physical evidence on the interface connector of another plug being
inserted into the connector on the drive.
> Let me clear up a little bit on my Q.
>
> no i was worrying about a theft, someone more smarter! Like what if he mounts the disk as read only (write blocker?) & creates a bit-to-bit dump of the hdd for later inspection. In this situation what are the other evidence left on the CHIPS/MEMORY of hdd itself helpful for a forensic examiner!? The only other thing i can think of was if the OS the hdd had... had run a SMART monitoring tool that keeps a fresh LOG of SMART status of the hdd @ every shut-down of the PC (as say shutdown script) examining the "power on time" (in hrs) before & after the theft maybe the only clue i can think of!
>
> WHAT ELSE ARE OTHER THINGS LEFT TO LOOK FOR IN THIS SITUATION?
Physical evidence on the interface connector of another plug being
inserted into the connector on the drive.
--
David Pick
[ reply ]