Record of backup to external hard drive??

Not unless the program you use to do the backup keeps a record of it.

 

I am sure you might know this but still for the rest of the users in here:

From a great pain that happend to my friends, family and many other people I know, PLEASE don't back up files on external hard drived as a single source.

Takes 5 minutes to burn them also on a DVD, takes a life time to cry about images from the last 5 years gone for ever.

 

Laura, there may be other forensic methods, but one that comes immediately to mind is the LastAccess Timestamp.

To verify: navigate to one of the files in question, right-click and bring up the property sheet, and view the 'Accessed' and 'Modified' timestamps.

I know that this won't tell you if the file's been copied, but at least you might get an idea if and when the file's been accessed and/or modified...

*******

Just thought of something else - when a file is copied, it is done so through RAM. There are ways to verify what's been loaded into RAM - if you wish, I'll try to dig up some examples...

 

This is not a directory as such but it is a free application that will find anything on your PC or external drives.

http://www.voidtools.com/

As you start to type the name of a file or folder or program it will immediately tell you where it is so as long as you can remember the name or part of it you can find it.
If you are like me and have multiple HDDs then it's great.

Edit/ it can even find files in the registry.

 

What kind of record are you looking for? In the properties window for the file, if you select the "Advanced" button there will be a "File is ready for archiving" item. If it is not checked then the document file has been copied at some point.

This is pure speculation, but if the XP machine is using ntfs then more information might be in the alternate data stream(s).

NTFS Multiple Data Streams at NTFS.com.
NTFS Streams at Audit My PC.com.
Streams at Window Sysinternals.

Streams is one of the utilities in the Microsoft Sysinternals Suite at MG.

 

The archival stamps and the streams angles look like the easiest ways. If you wish to dig really deep, you could go for the RamDump: http://www.mcgrewsecurity.com/tools/msramdmp/