If I want to know if someone was on my laptop two days ago or has been booted up, that goes through the event log. But that can be deleted. So then the other entries of the days before have to be deleted, right? Because individually can't delete it, right?
Can someone also from an external disk on my PC (without password) access? So that in the event display at all no traces are left?
I'm thankful for every hint.
On which PC have you ranked the rank?
To which is bound with the area51, one must be prepared for everything…
As you put it: no.
What you suspect: Yes, but with other methods.
Just make a boat password in the bios. Nobody can start the PC without your permission.
Oops have accidentally answered down here. : /
Why should I do that? Especially since I'm not the questioner.
Generally - and in short: nothing is good. You can still access the data if you have access to the PC.
I may have been stupid. So I had no password set up on my laptop. And suspect that on Friday between 17.30 and 19.00 someone (with expertise) was in my absence on my PC.
Would I be able to see that in the event viewer?
Is that possible without leaving a trace? If yes how?
Can an IT forensic company find out? I know it's expensive.
@ mchawk777 I did not mean you accidentally wrote under your answer.
Probably yes, but you have state secrets on your PC that you want to hire a company ne?
Maybe - but not necessarily.
Generally, something like that is logged, of course.
If the person had a second laptop and a screwdriver, you will not notice.
Depending on the size of the hard disk one has quickly copied an image of the disk for later analysis.
I read something in a forum from Linus Live CD boot and mount the harddisk read only. Whatever this could mean.
Oops, that should actually be in the comment on an answer.
Can you explain 51 memes with this area? Did I miss something?
600,000 people in America have joined a Facebook initiative to storm area51 and will probably not happen, only a few or so will go.
Thank you!
