I think someone might have taken my external hard drive and read its content. I know when I last accessed it, so if there were some way to know when was the hard drive last accessed I could know if someone has used it.
I've been reading some posts about the same issue, but I'm not sure yet how to do this task. I'm running WIndows and using a Toshiba external hard drive. The person who might have plugged it in uses OS X.
As far as I know, I should first deactivate automount option in WIndows, set mount to read-only and then mount the external hard drive in order to not alter the last access time. However, I think it also depends on the filesystem the external drive uses. As I've used it only with Windows, it might be NFTS (any way to find out without mounting the drive?), in which case OS X has only read-only option. If that's the case could I know if he has plugged the drive in?
I'm assuming the person is not a pro, so I don't think he would have done anything to hide any traces. I just want to know what are my options if we assume that he just took the drive and plugged it in to his computer. Please if someone knows and can explain me step by step I would be very grateful!
Thank you very much for your help!