Costa Help wrote:
> Hello reader.
>
> Could you please tell me wheather its possible, and how, to check through XP
> if RAM was removed form my PC what date it was removed?
>
> I handed my pc to a computre shop and I noticed a week lated that 256 mb of
> ram was missing.
>
> I would like to know if XP would have logged or recored the change somewhere
> with a date and time it was removed?
>
> Thank in advance for your help.
> Regards
>
Executive summary:
Without additional software, generally speaking, you cannot track the
inventory of hardware components inside the computer.
Your BIOS has a couple features, which are intended to help with such issues.
But they are not "forensic" in nature, and are not intended to convict
someone in a court of law. The BIOS features are there, to be used in
conjunction with third party software.
The first, and simple BIOS feature, is "intrusion detection". Some computers
have a switch on the cover of the computer case. If the cover of the computer
case is removed, the switch detects that fact. When you next start the BIOS,
the BIOS will put a message on the screen, stating that the cover has been
removed. That would be evidence, that the computer has been tampered with.
That does not help in your case, because you already know someone was inside
the computer, doing maintenance work on it.
The second BIOS mechanism, is the DMI table. DMI and ESCD are storage areas
inside the BIOS flash chip. Those ares contain an inventory list, of hardware
known to be in the computer. Each time you start the computer, the BIOS compares
the contents of the DMI list, against the hardware detected during POST. If
the hardware has changed, the BIOS code will flash upgrade the DMI and ESCD
tables in the flash chip.
Say for example, that yesterday the computer had three sticks of RAM. The DMI
table would show three sticks. Now, today, you remove a stick. During POST,
the BIOS compares the DMI, against the fact that there are only two sticks.
The BIOS then updates the DMI table, to show only two sticks. The DMI table
is only updated, if the hardware inventory of the computer has changed.
The purpose of the DMI, is to support computer utility programs. For example,
in a large corporation, every night, a program on the users computer, copies
the DMI table, and sends it to a central server. Thus, the server has a very
large database, that shows the hardware contents of the machine, collected
on a daily basis. For the example computer above, yesterday's DMI would show
three sticks, today's DMI would show two sticks, and you could conclude that
a stick was removed last night. By using the utility program and a central
server, you could tell a stick went missing overnight.
Using a computer program that accesses the DMI table, and records it every
day, is how you detect a change in hardware inventory. But that is virtually
useless for proving where the stick of RAM went.
Unless you had a program that copied the DMI every day, you would not be
able to detect a change in the DMI. If you read out the DMI today, it
will reflect the hardware contents of the computer today. If the DMI recorded
a date, when the DMI was last updated, that would give you a hint, but I
don't think it works that way.
Even if the DMI table contained a date, as to the last time the BIOS updated
the table, that still won't help you. As the technicians are working on
your computer, they could make innocent changes to the machine, that caused
the DMI table to be updated. The DMI table could get updated, as hardware
is removed and put back, during their testing.
Purely to demonstrate what the DMI records, get the Everest program
from here.
"EVEREST Free Edition 2.20"
http://majorgeeks.com/download4181.html
Install the program, and start it. From the menu, select "Report" then
"Report Wizard". Click "Next" in the first window. Click "Hardware-related
pages". Click "Next". Click "Plain Text". Click "Finish".
After a minute, a page of text will appear as the "Report". Scroll the window
down. All the text between these two headers, is the contents of the DMI table
from the BIOS flash chip.
--------[ DMI ]---------
--------[ Overclock ]----------
This is part of the DMI table from my computer. My computer has four DIMM
slots. The DMI did manage to record that I have 2x512MB in slot A2 and B2.
[ Memory Modules / DIMM A1 ]
Memory Module Properties:
Socket Designation DIMM A1
Installed Size Not Installed
Enabled Size Not Installed
[ Memory Modules / DIMM A2 ]
Memory Module Properties:
Socket Designation DIMM A2
Type DIMM, SDRAM
Installed Size 512 MB
Enabled Size 512 MB
[ Memory Modules / DIMM B1 ]
Memory Module Properties:
Socket Designation DIMM B1
Installed Size Not Installed
Enabled Size Not Installed
[ Memory Modules / DIMM B2 ]
Memory Module Properties:
Socket Designation DIMM B2
Type DIMM, SDRAM
Installed Size 512 MB
Enabled Size 512 MB
My BIOS did not manage to record the serial numbers of the DIMMs, even
though, in fact, my Crucial memory does have a unique serial number in
each DIMM. That is one of the problems with DMI, is quite inaccurate
recording of hardware inventory. Many BIOS designs prepare bad DMI
tables, and much of the information in the DMI table is nonsense.
This is why hardly anyone relies on DMI, for their information.
If you use software which logs the DMI table every day, and stores
it away, *THEN* you can detect missing hardware. But that is still
not proof of where the missing hardware went.
Paul
