Who's formatted my hard drive?

[Craglett]

Hi

I'm trying to help someone who has had their hard drive stolen and then returned anonymously but formatted. I'm going to try to help them recover their files but before I do anything, does anyone know of a method of tracing the activity on the hard drive? Does the format or delete function leave any trace of which computer carried out the operation?

I've tried searching but the articles I find are only relating to securely wiping hard drives, which is of course not what I want to achieve.

I hope you can help because I would like to catch the person who stole this students' hard drive to prevent it happening to someone else.

Thanks in advance
Craig

 

[Phillip Corcoran]

There won't be anything on the drive to identify the PC that was used to format it or to carry out any read/write operations on it.

Dabbing it for fingerprints may reveal something but you'd have to call in the law to have that done, and it'll be pointless anyway unless the thief has previous convictions with his prints held on a database.

It's not a serious crime so I doubt the police would want to follow it up anyhow.

 

[Craglett]

That's a shame. Fingers crossed they've been stupid enough to save something on there before deleting it and returning the drive.

Thanks for your help by the way.

Craig

 

[SortNVF]

well do let me know.
I kinda doubt youll find anything since whoever did it took the time to reformat.

Not that im making excuses, but could the drive possibly have been mistaken for someone elses, used to save whatever the days work was, then brought home. Mistake discovered, left on the shelf embarsingly long, then formatted o cover up and returned?

 

[McHenryB]

How do you know it's the same drive?

 

[Phillip Corcoran]

Good question.