Cardoso schrieb:
I don't think they can detect some highly advanced techniques like using
Partition Magic to mirror the disk..
As long as they didn't know the exact amount of hours the hdd was
running before it got stolen, i don't see any way to determine if the
data was copied away by some sector-by-sector copy-tool like Ghost or
True Image. Afaik you can see very clearly how many hours a drive has
run yet. If that data was the same as before the laptop was stolen, then
the disk didn't run. If the data differs, the drive did run.
I am not sure if one could alter that data.
On the other hand... i don't think that anyone knows that data all the
time, so they couldn't have known the running-time of the disk, unless
they knew the hdd was about to be stolen.
(pardon my bad english)
Michael
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/