Catches removed drives · by the serial number of every drive

Someone pulled a drive. You know within 15 minutes.

Not when the data turns up somewhere. The agent records the serial number of every drive, and the device passport shows whether encryption is on. That's the difference between a $100 loss and a breach you have to report to clients and regulators.

BUH-07 · accounting · Windows 11online

Components · drives 1 → 0 · snapshot #2 214 · 14:02

CPUIntel Core i5-12400BX8071512400OK

RAM2 × 8 GB Kingston8C5A…1D · 8C5A…22OK

SSDSamsung 870 EVO 1 TBS6PPNX0T4… → —MISSING

GPUIntel UHD 730—OK

14:02 drive missing · CRITICAL → Telegram, email, ticket #418

Catches GPU swaps · shows what was there and what is now

The GPU was swapped for a cheap one. We'll see it.

GPUs cost hundreds of dollars, and they're the first thing to walk out of labs and classrooms. We remember the model of every graphics card and log what was there, what's there now and when it changed. The alert arrives before anyone files a ticket.

LAB-12 · lab · snapshot #124 → #125online

Changes · Friday 13:47 · outside working hours

wasNVIDIA GeForce RTX 4090 · 24 GBsnapshot #124

nowNVIDIA GeForce RTX 3060 · 12 GB · a fraction of the pricesnapshot #125

CPUAMD Ryzen 9 7950XunchangedOK

RAM4 × 16 GBunchangedOK

13:47 GPU replaced · CRITICAL → Telegram, ticket #419

Catches rogue remote access · within 15 minutes of install

AnyDesk just showed up on the accountant's PC. Know before the attacker does.

A remote access tool you didn't install is the #1 way attackers get into companies. Any new program shows up within 15 minutes, and you mark your own tools as allowed, so everything else stands out right away.

BUH-03 · accounting · software, last 24 honline

Installed programs · 41 → 43 · two new overnight

+ newAnyDesk 8.1.0installed 13:10 · not on the listNEW

okScreenConnect 24.1your tool · allowedOK

+ newTeamViewer 15installed 09:42 · not on the listNEW

okSlack 4.39—OK

13:10 rule "new remote access program" → Telegram to the CEO, ticket

Catches unknown USB drives · checked every 15 s

An unknown USB drive is blocked until you approve it.

Every drive is checked against your allowlist, and on Windows and Linux the agent blocks it until you decide. You get a Telegram message, and approving it takes one click in the dashboard.

Telegram · hw·keeper bot · USB on REC-01: 0 → 1 unknown12:58

hw·keeper

REC-01 · reception
Unknown USB drive blocked.

Kingston DataTraveler 64 GB · VID 0951 · PID 1666
user reception · 12:58

Open in hw·keeper dashboard

Catches RAM swaps · serial number of every module

A RAM module was swapped for a smaller one. 32 GB became 24.

A typical inventory tool shows "24 GB" and can't tell you which module left or when. We store the serial number of every module, so we catch the swap even when the total stays the same.

CLASS-2-09 · computer lab · memoryonline

4 slots · ~~32 GB~~ → 24 GB · minus 8 GB

DIMM1 · replaced 12:15

~~16 GB~~ → 8 GB

~~8C5A…1D~~ → 2F19…7B

DIMM2 · unchanged

16 GB

8C5A…22

DIMM3

—

empty

DIMM4

—

empty

12:15 memory module replaced · 16 GB → 8 GB · CRITICAL → Telegram, ticket #420 · PDF for the office manager

Catches miners and banned software · within 15 minutes

A crypto miner runs on a workstation all night. Your power bill, someone else's coins.

A new program shows up within 15 minutes of install, not when the electricity bill arrives. A ready-made miner blocklist turns on with one click.

DESIGN-04 · design · software, last 24 honline · 9h 40m

Installed programs · 58 → 60 · both overnight

+ newXMRig 6.21installed 02:14 · minerBANNED

+ newNiceHash Minerinstalled 02:16 · minerBANNED

okAdobe Photoshop 2026—OK

okFigma—OK

02:14 miner · machine running since 17:30 · CRITICAL → Telegram, ticket #421

Catches BIOS changes · with the next snapshot

Someone changed the BIOS overnight. In the morning, nobody knows a thing.

A BIOS version change is an early sign of tampering. We see it with the next snapshot, with the exact time, before anything bad happens. Secure Boot and TPM status is in every device's passport.

SRV-02 · server room · BIOS and firmwareonline

Overnight changes · 0 → 1 · 03:14

BIOSversion2.17.0 → 2.18.0 · 03:14REVIEW

Secure Bootboot protectionenabledOK

TPM 2.0enabledunchangedOK

03:14 BIOS version changed overnight → Telegram to on-call, ticket #422

Catches unplugged monitors · by serial number

A monitor was unplugged at 23:40. By morning, it's gone from the office.

We know every monitor by its serial number (it's stored in the monitor itself, in what's called EDID). An after-hours disconnect lands in the log with the exact time, not in an inventory report a year later.

OFFICE-15 · office 15 · displays and peripheralsonline

Monitors · 2 → 1 · outside working hours

DisplayDELL U2722D 27"S/N CN0…7K → — · disconnected 23:40MISSING

DisplayDELL P2422H 24"S/N CN0…3MOK

USBkeyboard, mouseunchangedOK

23:40 monitor disconnected · CRITICAL → Telegram to security, ticket #423 · PDF with serial number

Catches missing laptops · when it was last online

A laptop has been offline for three days. The employee quit yesterday.

The agent records every time a machine checks in. If a laptop goes quiet for more than a day, an event appears in the log, so you know before HR closes the offboarding checklist, not a month later at the inventory count.

LT-042 · laptop · Dell Latitude 5540offline · 3d 4h

Status · ~~online~~ → offline · silent since Monday

Check-inlast seenMon Sep 27 · 18:12 · from the office3 DAYS

Usuallyevery workday09:00–19:00NORMAL

DriveSamsung PM9A1 512 GBencryption onOK

Tue 18:12 laptop silent for more than a day → "went offline" event, ticket #425

Start free How it works

01 / 09

50computers free

4 OSwindows · macos · linux · android

~10 MBagent — a single file

15 sUSB check

hw·keeper — all company computerslive · 15:07:43

Computers

248

Online

23193%

Changes, 24 h

Alerts

42 serious

14:02BUH-07 drive missingCRITICALSamsung 870 EVO 1 TB · S6PPNX0T4… → —

13:47LAB-12 GPU replacedCRITICALRTX 4090 → RTX 3060

13:10SALES-03 AnyDesk 8.1 installedNEWnot on the allowed remote access list

12:58REC-01 unknown USB driveREVIEWKingston DataTraveler 64 GB · blocked, awaiting approval

// What we catch

What we catch.

Every 15 minutes the agent compares what was in the computer with what's there now. Here's what it finds, in plain English.

S6PPNX0T4… → —CRITICAL

A drive was removed

Someone pulled a drive with work files out of a computer. Within 15 minutes you get a message: which drive, its serial number and when.

~~RTX 4090~~ → RTX 3060

A GPU was swapped

An expensive graphics card was quietly replaced with a cheap one. We remember every model and tell you right away: what was there, what's there now and when it changed.

AnyDesk NEWScreenConnect OK

Rogue remote access

A remote control program you didn't install appears on a computer. That's exactly how scammers get in. We spot it within 15 minutes of install.

Kingston 64GBREVIEW

An unknown USB drive was plugged in

Someone plugged in a USB drive that isn't on the allowlist. On Windows and Linux it's blocked until you decide. You get a Telegram message, and approving it takes one click in the dashboard.

~~32GB~~ → 16GBS/N 8C5A…1D → 2F19…7B

RAM was swapped

A memory module was removed or replaced with a smaller one. A typical inventory may show the same total, but the serial number won't match. That's what we track.

BIOS 2.17 → 2.1803:14 · overnight

BIOS and monitors

Someone updated the BIOS or unplugged a monitor overnight. That goes into the log too, with the exact time.

// Why regular inventory misses this, and HWKeeper doesn't

Regular inventory shows what's there now. It doesn't remember what was there yesterday.

IT asset inventory tools and remote management platforms (RMM) only record the current state. HWKeeper remembers the serial number of every part and compares snapshots: what was there and what's there now. The same machine in both systems:

Regular inventory · today

Memory8 GB

Drive1 × 1 TB

GPURTX 3060

USB drives—

ALL GOOD

HWKeeper · same machine

Memory~~16 GB~~ → 8 GB · module 8C5A…1D gone at 14:02

Drive1 × 1 TB · serial ~~S6PPNX0T4…~~ → S6PP3Q1R8… · a different drive

GPU~~RTX 4090~~ → RTX 3060 · replaced yesterday at 13:47

USB drivesKingston 64 GB · plugged in at 12:58 · blocked

4 CHANGES · 2 SERIOUS

HWKeeper doesn't replace the tool you use to manage computers: patching and remote access stay there. We run alongside it and tell you what it missed.

// How it works

One small program. Working a minute after install.

Nothing to configure or maintain. A single 10 MB file for Windows, macOS and Linux that runs in the background and stays out of the way. For phones and tablets there's an Android app.

CPU · memory · drive · USB
→ snapshot #1

It records what's in the computer

Right after install it records all hardware with serial numbers, the list of programs and connected devices. That's the baseline. Install with the installer or a single terminal command.

~~32 GB~~ → 16 GB
snapshot #124 → #125

Every 15 minutes it checks what changed

Each new snapshot is compared with the previous one. If anything differs (a memory module, a drive, a program, a USB drive), a record appears: what was there, what's there now and when.

IF AnyDesk appears
↓
THEN alert · block

You decide what to report

Rules are simple: "if a remote access program appears, message the CEO on Telegram." Quiet hours make sure only serious things wake you up at night.

email · Telegram
→ ticket #419

Alerts go where you'll see them

By email, Telegram or into your ticketing system via webhook. Optionally, a short weekly summary across all computers.

// 30-day report COMING SOON

After a month, you know exactly what happened to your computers.

Imagine every computer keeps a diary. Every 15 minutes it writes down what changed. After 30 days all the diaries roll up into one report: a single page, with numbers and no jargon.

30-day report · Example Ltd · September 1–3048 computers · EXAMPLE

17changes you didn't know about

4serious, need a look

44 of 48computers with no incidents

Month calendar one square = one day

quiet daysomething changedserious event

What changed 17 events

USB drives not on the allowlist were plugged inall blocked · 6 approved · 3 denied9

Remote access programs were installedAnyDesk ×2, TeamViewer ×1 · not by you3

Parts inside a computer were changedGPU on LAB-12 · memory module on CLASS-2-092

BIOS settings were changedSRV-02 · both times overnight2

A drive was removedBUH-07 · encryption was off1

What to do 3 items

Find the BUH-07 drive. Removed September 10 at 14:02; it held the customer database.
Check the LAB-12 GPU. An RTX 3060 has been in place of the RTX 4090 since September 17.
Ask who installed AnyDesk on BUH-03. If nobody did, hand the computer to security.

Download PDF Send to the CEO Show last month

15m

How it's built

Every 15 minutes the program checks each computer and records what changed: a memory module, a drive, a USB drive, a program. Like a diary that writes itself.

30d

What's in it

How much changed in total, what's serious, which days it happened, and a to-do list on the first page. No CPU load charts and no words you have to google.

Who it's for

The CEO, to know nothing is going missing. The office manager, to skip hunting for lost gear at the annual inventory. MSPs, to show clients what they're paying for.

This report is in development; the numbers in the example are a sample. The product already includes 180 ready-made reports and a weekly email summary.

// A record you can show COMING SOON

Found something missing? Get a report: what, where, when and who.

Finding the loss is half the job. Then you have to prove it: to management, security, your insurer. We keep every event with serial numbers and exact times, and turn it into a PDF report with one click.

EXAMPLE

Event report #418hwkeeper.com · Example Ltd

What happened: A drive was removed from the computer
Computer: BUH-07 · accounting
Part: Samsung 870 EVO 1 TB · serial number S6PPNX0T4…
Before: Present · check on Sep 10 at 13:47
After: Missing · check on Sep 10 at 14:02
When exactly: September 10, between 13:47 and 14:02
Encryption: Off on this computer: the data on the drive is readable
Notified: CEO (Telegram, 14:02) · ticket #418

generated automatically · Sep 10 14:03hwkeeper.com

👔

For management

What went missing, when and from which computer, on one page. Not "something seems off," but a fact with a serial number.

🔒

For security

To investigate a loss, you need a serial number and a time. The report has both, accurate to 15 minutes.

🛡️

For your insurer

The insurer will ask when it happened and how you found out. The answer is ready before they ask.

🙋

For employees

It protects honest people too: if someone was at lunch at 14:02, the report shows it, and nobody gets blamed.

One-click reports are in development. You can already export the event log for any period to a spreadsheet or print it to PDF.

// Install

A minute after install, the computer is on your list.

Download the installer, run it, done. The program starts reporting right away: the first snapshot arrives within a minute. No setup, no reboot, no waiting.

1min

First data arrives a minute after you run the installer.From then on the program runs on its own: it checks the computer every 15 minutes and tells you when something changes.