Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

Finding where a computer has been


  • Please log in to reply

#1
stevedee

stevedee

    New Member

  • Member
  • Pip
  • 1 posts
Dear Geeks - I wonder if anyone can help me. A laptop disappeared from my business a couple of months ago containing some sensitive data - customer information , financial records etc - it has now mysteriously re-appeared! I suspect whoever had taken it has finished with it and extracted whatever data they wanted and hoped to put it back so in the chance that we thought it had just been mislaid rather then stolen.

Is there anyway of tracing what IP address(es) it has been connected to while it was away or any other log files on Windows 7 that could shed any light on what programmes have been accessed and when?

Any help; gratefully received. Thanks very much.

You can email me direct on (E-Mail removed) if you wish to let me know you have replied or ask for further information but I guess other members may have had similar problems and may benefit from answers here. Thank you. Steve
  • 0

Advertisements


#2
Wolfeymole

Wolfeymole

    Member

  • Member
  • PipPipPipPip
  • 1,929 posts
Did you call the police as it sounds to be one of your staff who may have done this?
  • 0

#3
RKinner

RKinner

    Malware Expert

  • Expert
  • 17,339 posts
  • MVP
I would first look in the event logs to see if the notebook was turned on while it was gone.


Right click on (My) Computer and select Manage (Continue) Then click on the arrow in front of Event Viewer. Next Click on the arrow in front of Windows Logs Click on System. Scroll down and look for Event ID 6005 from EventLog. Each time you find one of these, note the time and date. These show when the computer was turned on. Long shot I suppose but perhaps it wasn't even on while it was gone. Did the computer have a password that was not well known? Perhaps even if it was on they never got into it. Go up one level in the logs on the left and select Security. Look for the dates and times it was turned on and see if there were any successful logons. Perhaps they couldn't get in so brought it back?

Then look at:


Network Interfaces on http://web.nmsu.edu/...ry_DETAILED.pdf

and also see:
http://www.irongeek....le-system-spots

Lots of good info.
  • 0

#4
Niyol

Niyol

    Member

  • Member
  • PipPipPip
  • 160 posts
Hello
You could have a look at the history in the browser and check if they connected to any sites if any have been connected to e-mail the owner of the site explain your predicament and see if they have a list of IPs for that day and time you may be able to get the IP that way.
Before you do that you'd need to check they actually got in to the laptop.

You didn't say what security you have on the laptop as you may have a firewall that saves IP's like mine and can check both in and outgoing there.

Another thing I'd do is check they didn't install anything on to the laptop, such as keyloggers, malware ect, and don't connect it to anything before you have scanned. Maybe this is overkill but it does not hurt to air on the side of caution.

I think also you can get tracking software now to install on your pc that has the ability to delete the HD remotely if such an incident occurs again and I think it tracks the Pc's location. Maybe one of the tech Geeks knows what its called as I can not remember.

Good luck :thumbsup:
  • 0

#5
phillpower2

phillpower2

    Tech Staff

  • Technician
  • 20,019 posts

Maybe one of the tech Geeks knows what its called as I can not remember.

Would it be Prey by any chance o0o http://preyproject.com/ or LoJack perhaps http://laptop-tracki...ack-review.html
  • 0

#6
Niyol

Niyol

    Member

  • Member
  • PipPipPip
  • 160 posts
Philpower2 yes that's the kind of programs I was thinking off, sorry if I was a little vague, my memories not so good.
Some paid for anti virus software also combines it into there software bundle too so it maybe worth while checking your security on the lap top/s to see if it is included then if it did occur again you'd be ready.
  • 0

#7
phillpower2

phillpower2

    Tech Staff

  • Technician
  • 20,019 posts
Thanks o0o :thumbsup:

Hopefully the OP will return to pick up the information :)
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP