[stevedee]

Dear Geeks - I wonder if anyone can help me. A laptop disappeared from my business a couple of months ago containing some sensitive data - customer information , financial records etc - it has now mysteriously re-appeared! I suspect whoever had taken it has finished with it and extracted whatever data they wanted and hoped to put it back so in the chance that we thought it had just been mislaid rather then stolen.

Is there anyway of tracing what IP address(es) it has been connected to while it was away or any other log files on Windows 7 that could shed any light on what programmes have been accessed and when?

Any help; gratefully received. Thanks very much.

You can email me direct on (E-Mail removed) if you wish to let me know you have replied or ask for further information but I guess other members may have had similar problems and may benefit from answers here. Thank you. Steve

[Advertisements]

Did you call the police as it sounds to be one of your staff who may have done this?

[Wolfeymole]

Did you call the police as it sounds to be one of your staff who may have done this?

[RKinner]

I would first look in the event logs to see if the notebook was turned on while it was gone.


Right click on (My) Computer and select Manage (Continue) Then click on the arrow in front of Event Viewer. Next Click on the arrow in front of Windows Logs Click on System. Scroll down and look for Event ID 6005 from EventLog. Each time you find one of these, note the time and date. These show when the computer was turned on. Long shot I suppose but perhaps it wasn't even on while it was gone. Did the computer have a password that was not well known? Perhaps even if it was on they never got into it. Go up one level in the logs on the left and select Security. Look for the dates and times it was turned on and see if there were any successful logons. Perhaps they couldn't get in so brought it back?

Then look at:


Network Interfaces on http://web.nmsu.edu/...ry_DETAILED.pdf

and also see:
http://www.irongeek....le-system-spots

Lots of good info.

[Niyol]

Hello
You could have a look at the history in the browser and check if they connected to any sites if any have been connected to e-mail the owner of the site explain your predicament and see if they have a list of IPs for that day and time you may be able to get the IP that way.
Before you do that you'd need to check they actually got in to the laptop.

You didn't say what security you have on the laptop as you may have a firewall that saves IP's like mine and can check both in and outgoing there.

Another thing I'd do is check they didn't install anything on to the laptop, such as keyloggers, malware ect, and don't connect it to anything before you have scanned. Maybe this is overkill but it does not hurt to air on the side of caution.

I think also you can get tracking software now to install on your pc that has the ability to delete the HD remotely if such an incident occurs again and I think it tracks the Pc's location. Maybe one of the tech Geeks knows what its called as I can not remember.

Good luck

[phillpower2]

Maybe one of the tech Geeks knows what its called as I can not remember.

Would it be Prey by any chance o0o http://preyproject.com/ or LoJack perhaps http://laptop-tracki...ack-review.html

[Niyol]

Philpower2 yes that's the kind of programs I was thinking off, sorry if I was a little vague, my memories not so good.
Some paid for anti virus software also combines it into there software bundle too so it maybe worth while checking your security on the lap top/s to see if it is included then if it did occur again you'd be ready.

[phillpower2]

Thanks o0o

Hopefully the OP will return to pick up the information