Computer was stolen from a friend.

C

creedAMD

2[H]4U
Joined
May 29, 2000
Messages
3,861
Friend of mine had a computer stolen, it was on his home network, there was another computer that was booted up at the time, is there a way to check what time the stolen computer shut down by looking at the computer that was left up and running? Both machines are windowsxp.

Thanks.
 
This begs the question... how was this computer stolen? Did someone break into his house and steal just his computer?
 
came in through a window, stole the one tower and left, I just wanted to get a estimated time
 
No I cannot see how this would be possible. Even with a domain, I really can't see you being able to tell an EXACT time, unless they did some printing or something first.

QJ
 
If it was on a domain and you had events logged you could possibly see. But other than that, nope.


Couldn't someone track down the stolen computer using the mac address if the person wrote it down before hand?
 
doesnt the router have the name of every computer and every mac address in it that was ever connected at one time?
 
Perhaps I am just missing something here. I don't remember seeing you say the event log service wasn't started or anything


Check the event log. You'll see an event for Event log started. It's an informational event. Maybe XP Home doesn't log this event normally? Of course you didn't say what OS your runnng but I would assume XP otherwise. Event viewer. Should be withing a couple of minutes depending on how fast that computer boots.
 
If you had drives mapped or printers shared then you should be able to see when the disconnect occured by checking your event log.
 
windows xp prof on both computers, there was a printer being shared on the stolen computer, how do I access the event log to see when the disconnect was?

Thanks for your time.
 
people should put a hidden "ping home" program on their puter that uses IRC or email or something to call home and check in. especially for laptops.
 
Well, I am wondering if having the mac address will help. It's an HP, so I am sure they have it on file.
 
"how do I access the event log to see when the disconnect was?"

Right click on My Computer and click manage. Go to the event viewer, System and look for an informational event. The source will be Event Log. This isn't a share disconnect, this will be when the event service started, meaning when that machine booted up. If that computer was started when the other was stolen you'll have your time frame.
 
You must log in or register to reply here.
Back
Top