Method and system for detecting infection of an operating system

A computer-based method for detecting an infection of a first operating system, the method comprising:

• booting a computing device with a processor and memory under control of the first operating system and loading a suspect storage device having a plurality of files;
• requesting that the first operating system provide file properties of the plurality of files stored on the suspect storage device, the file properties provided by the first operating system being first file properties, such that when the first operating system is infected, it provides first file properties of the plurality of files that are inaccurate in an attempt to conceal the infection of the first operating system;
• storing the first file properties provided by the first file system;
• booting the computing device with the processor and memory under control of a second operating system and loading the suspect storage device, the second operating system being known to be clean;
• requesting that the second operating system provide the same file properties of the plurality of files stored on the suspect storage device, the file properties provided by the second operating system being second file properties;
• storing the second file properties provided by the second file system;
• and
• comparing by the computing device the stored first file properties and the stored second file properties to identify differences that may indicate an infection of the first operating system based on the first file properties being inaccurate.