can I find out when a drive was last connected or accessed?

[kenny1999]

I have a few portable hard drives and flash drives. They haven't been powered (or connected) for quite some time. Is it possible to find out when they were last powered (or connected)?

[Sensei]

It depends on how it was connected to the computer, file system on drive, and which operating system you are using..

If the device was connected with your consent via a USB adapter and it is Windows the information about connected USB devices can be in HKEY_LOCAL_MACHINE / SYSTEM / CurrentControlSet / Enum / USBSTOR.

https://www.cybrary.it/blog/usb-forensics-find-the-history-of-every-connected-usb-device-on-your-computer

ps. Generally unreliable. Easy to fake if somebody has some malicious purpose.

Some file systems store information about when a file was created, modified and last accessed.

Edited May 31 by Sensei

[kenny1999]

20 hours ago, Sensei said:

It depends on how it was connected to the computer, file system on drive, and which operating system you are using..

If the device was connected with your consent via a USB adapter and it is Windows the information about connected USB devices can be in HKEY_LOCAL_MACHINE / SYSTEM / CurrentControlSet / Enum / USBSTOR.

https://www.cybrary.it/blog/usb-forensics-find-the-history-of-every-connected-usb-device-on-your-computer

ps. Generally unreliable. Easy to fake if somebody has some malicious purpose.

Some file systems store information about when a file was created, modified and last accessed.

Hello. Generally unreliable? What did you mean?

I am not living alone and someone in my home may use my drives without my permission and he will lie. But I can assume that he isn't a tech geek and will not be able to do anything advanced.

But, when I connect (and thus power) the drive again, will the last accessed time be updated to the current time so I won't be able to find out the time I am actually  interested?

[Sensei]

There is a flash drive with a built-in keypad where you have to enter a PIN code to access it.

https://www.ebay.com/itm/395407083462

so, unauthorized person will have difficulty at accessing it..

 

If you format a flash drive to ext4 instead of NTFS/FAT32/exFAT, it will not be accessible from a standard Windows OS, only from Linux.

 

There are data encryption programs, which you might use..

7zip and zip have built-in encryption algorithms.

 

[kenny1999]

21 hours ago, Sensei said:

There is a flash drive with a built-in keypad where you have to enter a PIN code to access it.

https://www.ebay.com/itm/395407083462

so, unauthorized person will have difficulty at accessing it..

 

If you format a flash drive to ext4 instead of NTFS/FAT32/exFAT, it will not be accessible from a standard Windows OS, only from Linux.

 

There are data encryption programs, which you might use..

7zip and zip have built-in encryption algorithms.

 

Sorry but please forget about encrypting the hard drives or flash drives.

I only wish to know how I will be able to find out the "actual" last accessed time of the drives but not the current time when it is connected by me.

Thanks.

[Sensei]

11 hours ago, kenny1999 said:

Sorry but please forget about encrypting the hard drives or flash drives.

This is the most reliable way to prevent unauthorized access to files you do not want to share with others.

 

11 hours ago, kenny1999 said:

I only wish to know how I will be able to find out the "actual" last accessed time of the drives but not the current time when it is connected by me.

I already said - it depends on the operating system and the file system used.

Windows OS has functions SetFileTime. Read the docs.

https://learn.microsoft.com/en-us/windows/win32/api/fileapi/nf-fileapi-setfiletime

and GetFileTime

https://learn.microsoft.com/en-us/windows/win32/api/fileapi/nf-fileapi-getfiletime
 

Quote

 

Remarks

Not all file systems can record creation and last access times and not all file systems record them in the same manner. For example, on FAT, create time has a resolution of 10 milliseconds, write time has a resolution of 2 seconds, and access time has a resolution of 1 day (really, the access date). Therefore, the GetFileTime function may not return the same file time information set using the SetFileTime function.

NTFS delays updates to the last access time for a file by up to one hour after the last access. NTFS also permits last access time updates to be disabled. Last access time is not updated on NTFS volumes by default.

Windows Server 2003 and Windows XP:  Last access time is updated on NTFS volumes by default.

 

 

From the user's perspective, RMB on the file and use Properties, and you will have there the timestamps of creation time, last write and last access.

 

On 6/1/2024 at 8:41 PM, kenny1999 said:

Generally unreliable? What did you mean?

"not able to be trusted or believed"

https://dictionary.cambridge.org/uk/dictionary/english/unreliable

i.e., it can be easily faked.

 

 

If someone connects your disk to Linux, you will have nothing..  i.e. you will have the misconception that it has not been read.

I clicked RMB on some files on VBox with Win10, opened the Properties window and now I see that it caused an update of the last access time..

 

[swansont]

6 hours ago, Sensei said:

This is the most reliable way to prevent unauthorized access to files you do not want to share with others.

!

Moderator Note

That wasn’t the issue that was presented. The question asked is “can I find out when a drive was last connected or accessed?”

It’s not unreasonable to request that you stick to the topic