Used AlarmDisk for Windows?
Editors’ Review
With a minimum of fuss and little user interaction, this freeware accurately monitors ATA drives to detect actual powered-on states versus expected values.
AlarmDisk's plain interface simply lists drives tracked and event log data. Novices could install this app and read the collected information without consulting the thin Help manual. Installing the app takes just a few moments and requires little intervention. The program loads at system start-up and sits in the tool tray. A simple tray button displays green, yellow, or red to indicate if the system had been booted off something other than the tracked ATA disk. A plain text log file displays errors and alerts at each system boot.
This program works only with ATA drives, and doesn't indicate why other drives are not listed. That's not a problem for experienced users, but could confuse novice users. That's a minor quibble for a simple program for those users who want to monitor unauthorized drive activity.