Dee, if you do replace a hard drive in a computer, do you get a message that says something like, the case has been opened? One of the computers at work had some boards replaced, mother board I think, and every time you powered it up you'd get that message. If he tampered with the computers, could an expert tell?
It depends on the type of PC. If it is a Dell or Gateway, they usually have warranties and tamper-tape on them. You'd be able to tell if the case has been opened if the tamper-tape has been removed or cut. In my experience, I have never seen a PC that actually tells you when the CASE itself has been opened, because the boards typically are never wired directly to the case.
Most newer PC's are fully upgradeable anyways so once the PC is out of warranty, a user can open the case and upgrade whatever components they'd like (motherboard, hard drives, CPU, graphics cards, drives, etc.).
If the hard drive in a PC was replaced by a pro, you wouldn't get any messages upon startup about the hard drive (HDD), because the pro would have properly set up the HDD in the system BIOS.
If replaced by a novice, there may be an error message upon start up, typically related to not setting up the HDD in the system BIOS properly, but that's nothing that a PC person, especially a LE forensics expert can't deal with.
I'd assume that LE would either set up the BIOS on the original PC to recognize the HDD or even more likely, remove the HDD entirely and put into another PC, maybe one they use exclusively for investigation. This would reduce the likelihood that the PC may have been wired to short the HDD (which could also fry it and/or corrupt sectors on the HDD, rendering them unreadable).
