Whodunnit - RAM and XP forensics

[SefDef]

Perhaps somebody here likes detective work?

I brought my Toshiba Satellite P105-S6064 to an authorized service center 2-3 weeks ago because:
- The keyboard regularly missed keystrokes (a common complaint for this model)
- BSOD (multiple fault) when logging in a second user via the fingerprint reader (only)
- Waking up from hibernation upon lid-closing and while closed in a bag
- circumferential scratches on DVDs

I got a courtesy call about 11 days later from the service tech. He said he had ordered a keyboard and a DVD drive. He mentioned that Toshiba had replaced a lot of system boards due to manufacturing problems, as if that might be the solution to the other problems.

He called again later to say that the system was not stable, so he had ordered a new system board. I was surprised to hear that, but why complain? Regardless, that one BSOD was the only one I ever saw.

Today he called back and said that when Toshiba asked for serial numbers off the parts, he noticed that one of the RAM sticks was not a Toshiba part at all, and that it was 512MB rather than the 1GB (half of 2GB OEM) it should have been. He had then tried booting with and without the suspect RAM stick, and found that it was the problem - It was faulty, as well as being the wrong part.

My first thought was that I had bought a display model at Office Depot, and that some employee or customer had been naughty. My second thought was that I was sure I had seen it report 2GB to me in more that one way, and that a RAM stick going bad AFTER I handed it in for service seemed extremely unlikely. Of course the shop could imagine a lying customer, but then they had seen it running smoothly themselves while it was in their possession.

Only one conclusion, as far as I can see: Someone swapped it out in the shop. Maybe it was borrowed for someone else's diagnostic effort, maybe it was taken for someone else's laptop, who knows. An aftermarket replacement is maybe $120 for the pair, but Toshiba's price is apparently $360 for one. Even the smaller cost is not easy for me to accept.

So now I am looking for forensic resources. Here's what I have so far:
- I could check the size of the hyberfile, but wouldn't that just be 2GB because the system once had 2GB in it?
- I could check the BSOD dumps to see if they give information about RAM size; then I actually have a time stamp

I can't think of anything else right now. I need something like:
- an individual boot log that gives basic resource info with a time & date, not overwritten
- a record of a change in RAM capacity
- any other app that may log system information like that

Any ideas?

[johnny_quest]

Well in my experience anytime I had one of those, """techs""" work on my laptops under warranty, the first thing they do is a full system restore... so there goes the bsod dumps if you didn't back them up.

even when i sent mine in for a bad battery, they do a restore, then send me a new battery...

[Ajmukon]

First, complain to the ""tech"", then ask to see the manager
usually, you will get some "free" stuff to make you, the customer, happy