How to tell who accessed what...

Good evening all,

I have recently made the sin of taking my PC to a local shop who turned out to be a big "cowboy".

The problem is that I am concerned what files were accessed and copied whilst my machine was in their care. Is there any way to see what files have recently been accessed and/or copied?

I am using Vista (soon to change... money permitting).

Thanks in advance,
S

 

Thank you so much.

I have a feeling they basically mirrored my hard drive... not impressed!

 

Not always, if i take a program designed to be non instrucesive, ie a forensic program, i can easy ghost a whole hd with out leaving anything on it, via a live cd boot, or pull drive and put into another machine. Basiculy if ya got stuff your worried about in the future wipe the drive and or use other storage methods other then local for that data. Once a machine leaves your hands, its untrusted at that point.

 

Can you explain to me further how you would check the USBSTOR key? Sorry to be a moron.

Bit paranoid, but I just do not trust so many of these local traders!

Thanks all.

 

One thought is that depending on the reason for the repair, a shop might image your drive under the idea of "Do no harm". If they were troubleshooting a software problem they might take a temporary image of your drive as a backup so that if something should go wrong during troubleshooting they could restore your HD to its original state. I seem to have read posts where this is standard practice in some repair shops.

 

For the paranoid..
http://consumerist.com/2007/07/vide...ad-stealing-porn-from-customers-computer.html

But like some else stated a boot cd would bypass this.

 

How does windows know what im accessing, if im not every booted to it?

 

Thanks for this dude. I think this may be the case, but cant help but wonder. I even dropped them a note asking an innocent (I saw you removed some stuff... do I need to get it back from my external - HDD?) and they seemed to give a legit answer, but you never know...

Still cannot tell what exactly was or wasnt accessed either. Tried the DIR route, but my PC didnt seem to have a time stamp at the time and a lot of entries were coming up as "NA" via the other methods.

If anyone can let me know, I would appreciate it.

In the mean time I am going to take a list of programs installed, back up my data and give it a complete wipe!