Cardoso schrieb:
As long as they didn't know the exact amount of hours the hdd was running before it got stolen, i don't see any way to determine if the data was copied away by some sector-by-sector copy-tool like Ghost or True Image. Afaik you can see very clearly how many hours a drive has run yet. If that data was the same as before the laptop was stolen, then the disk didn't run. If the data differs, the drive did run.I don't think they can detect some highly advanced techniques like using Partition Magic to mirror the disk..
I am not sure if one could alter that data.On the other hand... i don't think that anyone knows that data all the time, so they couldn't have known the running-time of the disk, unless they knew the hdd was about to be stolen.
(pardon my bad english) Michael _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/