tracking a stolen harddrive

[MELVIn]

my friend just wrote this on facebook:

"some sneaky little bastard actually stole one of my hard drives from my lap top... how fucking random is that?"


SO, I came to think of this one CSI episode, where they tracked a stolen harddrive over the interwebs, and I thought "I wonder if it's possible in real life?"


Is it actually possible? I'd imagine that one could find some information about it somewhere in the registry, like a serial number or something, and then somehow track it down over the internet if the person who did this put it in his computer and connected to the internet.

Any ideas?

[Major Banter]

Impossible. Simply put.

Because I, like anyone with a brain, would format the HDD.

[MELVIn]

I find it hard to believe that someone would steal a harddrive in this way and then format it right away. And even if they did, there must be some trackable info that doesn't go away by a simple format.

[xoqolatl]

Possible, because with sufficient privileges you can use Windows Management Instrumentation (or other interfaces on other OSes) to read the hard drives serial number. Serial can be spoofed temporarily (until next restart) with sufficient privileges, but if you had several suspects with similar drives, you could identify the stolen one even if it was formatted (assuming you knew the serial number of the stolen drive). So possible, but extremely unlikely in most cases.

Now doing this over the internet would require you to gain admin privileges on his machine and have an application check the serial number and phone home. Lots of AV suites will prevent you from doing that, and even if the guy doesn't use any AV, how do you plan to get him to run a random app as an admin?