A question to computer experts

[Toots]

Is it possible to know if your computer has been gone through? I believe that when the Democratic Senators were sent Anthrax and had to vacate their offices for a few months that GOP operatives went through all the computers and was just wondering if there was anyway to tell if that had happened..I know that there is a way to find stuff even after it has supposedly been erased but do they leave a trail when searching?

[Brundle_Fly]

1. for a home system not really

you can get bots to record every keystroke but you have to have access to them, I imagine the senate has tracking for all the systems.

but people who would be spying might erase their trakcs....


on edit.

when Rockefeller contacted Cheney and wanted to keep it secret, he wrote it by hand, So I think we can assume they have tracking

[sabra]

2. you mean besides leaving Cheetos colored finger prints on keyboards?

There are various ways to monitor activity, especially if it was on a network.

[TechBear_Seattle]

3. Not really

If you are very paranoid, you can obtain (or write, if you are the programmer type) a daemon service that will monitor file accesses and the like, but they are pretty easy to bypass if someone is serious about snooping. You can also look for physical changes, like your mouse or keyboard having been moved, but proving that it was a snoop as opposed to a janitor would be very difficult.

[DS1]

4. with physical access to your machine

and if it was left 'off' someone could open the case, ghost your drives in minutes, close it back up, and walk off with an identical copy of your data

[deadmessengers]

6. Bingo

Beat me by one minute.

[Tandalayo_Scheisskopf]

7. It gets even better:

There is a company out there that makes a small, handheld-type device for law enforcement that plugs into your computer and drags off an image down to the physical level of the platters in your HDD. From what I understand, it does this rather quickly as well.

Just the thing for a black bag op.

[GCP]

8. and if they're wanting to catch you in the act

and you have some sort of heavy network encryption - and they can get close enough - they can pick up the interference from your CRT and recreate what you're seeing on your screen :-)

[deadmessengers]

5. Not if the person doing it was smart

If you start with physical access to a powered-off unattended computer, it's basically untraceable. It works something like this:

1) Open the case of the PC
2) Remove the hard drive
3) Place the hard drive into another machine
4) Using the second computer, make a an "image" of that hard drive - basically, a forensically-sound copy containing everything on the drive.
5) Replace the hard drive into the original machine.
6) Examine the copied image at your leisure.

Most mass-market desktop PCs do not have case-intrusion sensors, and nothing would ever be logged.