Laptop miraculously returned after stolen, check history?

R

revo2001

[H]ard|Gawd
Joined
Feb 24, 2004
Messages
1,055
My bosses laptop was missing all day yesterday and some how today miraculously appeared.

Without having any tracking software, what are some ways that I could go about checking to see what documents were opened, emails read, etc?

Thanks guys.
 
check the event logs also - all of them.

in case you're not familiar - Start>Run>Eventvwr.exe will get you there
 
I would strip the laptop apart to look for any spying bug or GPS tracking device :p
 
I would smash it to pieces. The KGB have put bugs in it to steal secrets. What's that you say, he misplaced it? Sorry, it's already smashed.
 
|CMF|SoulAssassin said:
How would you go about executing a Script ?
Click to expand...


Well it depends on the script, but most windows scripts, such as VBScript, allow you to just double click on them and they will start to run. You could also setup a scheduled task to have it run periodically.
 
revo2001 said:
My bosses laptop was missing all day yesterday and some how today miraculously appeared.

Without having any tracking software, what are some ways that I could go about checking to see what documents were opened, emails read, etc?

Thanks guys.
Click to expand...

Unless you disabled it, there's always "My Recent Documents" in XP or "Recent Items" in Vista's start menu.

If you're using Vista, document histories are stored in C:\Users\<user name>\AppData\Roaming\Microsoft\Windows\Recent

If you're running XP, document histories are stored in C:\Documents and Settings\<user name>\Recent

To further investigate, if you're running Office 2007, a list of recently viewed documents will show up by default in the right pane when you click the Office Orb (upper left corner of Excel, or Word or whatever).

If you're using Internet Explorer or Firefox, you can see what web sites they've been on by opening Internet Explorer or Firefox, then pressing CTRL+SHIFT+H to view it's Browsing History.

As others mentioned in previous posts, also check your Event Viewer, especially to see who logged in - the thief might not know his boss's password and was forced to use his own. If the thief works for the company, chances are he has his own log-in account. By default, anyone can log into any computer on a domain with their own log-in. A new profile will be made for them.

Keep in mind, histories can be deleted. Might want to use a portable undeleter app on a thumb drive to scan his drive for deleted histories.
 
After you have investigated to your satisfaction, I think a format and reinstall would be a good idea. Call me paranoid, but a planted keylogger or other nastie would really suck.
vage said:
You could make a pretty easy VBScript script that would go through and compare the last accessed date of each file today's and if it was accessed yesterday, print the name to a file. Here is a good base script to get started at least.
http://www.kombitz.com/2005/05/10/111574517708105364/
Click to expand...
Great idea here...

edit: Not to make light of your situation, but I had a chuckle thinking " I hope he didn't have any "compromising" photos on there".:D
 
You must log in or register to reply here.
Back
Top