从Linux Live发行版启动挂载Windows硬盘，是否会留下可追踪痕迹？

Got it, let's walk through how you can track this kind of unauthorized activity even with just a standard user account on Windows 7. Since the attacker is booting from external media (USB/CD) instead of loading Windows directly, Windows' native boot logs won't capture that initial boot—but there are still plenty of traces you can dig up without admin rights:

1. NTFS File System Artifacts (Most Reliable) #

Linux Live environments use NTFS drivers (like ntfs-3g) to mount Windows partitions, and these leave detectable traces in the NTFS file system itself:

• Check for unexpected chkdsk runs: If Linux didn't properly unmount the NTFS partition, Windows will automatically run chkdsk on next boot. To verify this:
  1. Open Event Viewer (type eventvwr.msc in the Run dialog—standard users can access this)
  2. Navigate to Windows Logs > Application
  3. Look for events from the source Wininit with Event ID 1001—these contain chkdsk run details. If you see chkdsk runs you didn't initiate, it's a strong sign the partition was mounted externally.
• Inspect file access/modification times: Use built-in commands to spot unusual activity on your user directory:
  • Command Prompt: dir /ta "C:\Users\YourUsername" /S (lists files with their last access time—look for times when you weren't using the PC)
  • PowerShell: Get-ChildItem -Path "C:\Users\YourUsername" -Recurse | Select-Object Name, LastWriteTime, LastAccessTime | Sort-Object LastAccessTime -Descending

2. Removable Media Connection Traces #

Windows 7 logs all USB devices that have ever been connected to the PC, even if they were used to boot:

• Use PowerShell (standard users can run this) to list all previously connected USB devices:

  Get-WmiObject Win32_USBControllerDevice | ForEach-Object { [Wmi]$_.Dependent } | Select-Object DeviceID, Description, Manufacturer | Sort-Object Description
  

• Look for unfamiliar devices (e.g., a USB drive labeled "Linux Live" or a generic USB storage device you don't recognize) with connection timelines that match when you suspect the unauthorized access happened.

3. User Directory Change Verification #

If System Restore is enabled on your PC (most default setups have this), you can check for unexpected file modifications/deletions:

• Right-click your user folder (e.g., C:\Users\YourUsername) → Properties → Previous Versions
• Look for restore points created at times you weren't using the PC—you can compare the contents of these versions to your current folder to spot missing or altered files.
• For a quick check of recent changes, use Robocopy in Command Prompt (no admin rights needed):

  robocopy "C:\Users\YourUsername" "C:\Temp\DummyCheck" /L /E /XO /MINAGE:1
  

  The /L flag makes it only list changes (not copy files), /XO excludes older files, and /MINAGE:1 targets files modified in the last 1 day. Adjust the number to match your suspicion window.

4. Linux Live-Specific Hidden Files #

Some Linux Live distributions leave small hidden files on mounted NTFS partitions. To check for these:

• Open Command Prompt and run: dir /a:h "C:\" (lists all hidden files in the root directory)
• Look for Linux-specific files like .bash_history, .livecd, or .persistence—these are dead giveaways that a Linux environment mounted the partition.

内容的提问来源于stack exchange，提问作者user818347