General discussion

Locked

Locating a Stolen PC

By MikeyTino ·
My computer was stolen from my dorm room last week. I believe the theif is still on campus or even in my building, and most likely on the network. I had ResNet search the network for my specific Computer Name, but no luck. I assume they may have formatted. I was hoping they aren't smart enough to change the NIC, but I do not know the MAC address of that NIC. I log on to an Outlook Web Access MS Exchange Server 5.5. Will that log my MAC address? If so I can call the admin and get it. Is there any other way you think I may be able to do a thorough search of my network for the computer name? I need to catch this jerk! Thanks

This conversation is currently closed to new comments.

14 total posts (Page 1 of 2)   01 | 02   Next
| Thread display: Collapse - | Expand +

All Comments

Collapse -

Locating a Stolen PC

by timwalsh In reply to Locating a Stolen PC

Exchange does not log MAC addresses. Even if it did, since you don't know the one from your computer, it wouldn't do you much good.

Searching for a computer name is not going to do you much good either. Unless computer names are assigned, there would not be anything to stop someone else from using the same name (other than the fact that duplicate names can cause problems on the network). I don't think you would have much of a case with the campus police just because you found a computerwith the same name.

Even if you did find a computer with the same name or with your MAC address (if you knew it), tracking either of these to a specific physical location would be almost impossible. At best, if your campus network used differentphysical subnet for each dorm, you might be able to track it to a given building, but that's all.

I'm sorry, but you are pretty much out of luck.

Collapse -

Locating a Stolen PC

by MikeyTino In reply to Locating a Stolen PC

Poster rated this answer

Collapse -

Locating a Stolen PC

by MikeyTino In reply to Locating a Stolen PC

Point value changed by question poster.

Collapse -

Locating a Stolen PC

by MikeyTino In reply to Locating a Stolen PC

I believe there may be XP another computer on my network in my workgroup that was mine, just with a new Computer name. Is there a way I can somehow obtain information on it, such as OS and possible specs? There is nothing shared on it, but it is visible on the network.

Collapse -

Locating a Stolen PC

by MikeyTino In reply to Locating a Stolen PC

Point value changed by question poster.

Collapse -

Locating a Stolen PC

by cavedweller In reply to Locating a Stolen PC

The manufacturer might be able to tell you the MAC, especially if it was imbedded on the motherboard.

Network switches maintain lists of MAC addresses attached to each of their ports. I don't know how your campus network is set up. If it was wired recently there might be a single user jack on each switch port so that would lead you directly to the connected device. The only problem is that there are likely to be a lot of switches to check. Sometimes each switch port serves a floor or group of rooms. That would narrow the search a little.

Looking to see what devices were connected to your room's switch won't help. The switch only maintaines the MAC addresses for a few minutes after the connection is broken.

There are a few products designed to get a stolen laptop to contact a security service when they are reconnected to the network. This won't help you now but might help you in the future. There are also some handy devices that let you lock your laptop to an immovable object.

Collapse -

Locating a Stolen PC

by MikeyTino In reply to Locating a Stolen PC

The question was auto-closed by TechRepublic

Collapse -

Locating a Stolen PC

by mshavrov In reply to Locating a Stolen PC

If you have had Brand Name computer, look for your papers, may be you have "proof of purchase", you may have some serial numbers, like CPU, motherboard, hard drive or even NIC MAC address. I know that new Intel CPUs has Serial Numbers, but I don't really know if it's possible to read it remotely. But in this case you may just check computer physicaly and prove that it's your computer.

If you have MAC address, only way to track it - check LAN Switch where this computer is connected. MAC address in the packet is changed every time when IP packet crosses any router. So, it has only "local value". But if you have IPX protocol in your network, you may see MAC addresses for all computers in the network, since it's part of IPX address.

One more way is to check new computer if it matches to configuration you have had. But it depends on what OS is installed, how it's configured, if it allows to have remote access, etc. But again, easiest way is to look for new computers in your network and check them physically. And hear for rumors (social engenering).

Good luck.

Collapse -

Locating a Stolen PC

by MikeyTino In reply to Locating a Stolen PC

The question was auto-closed by TechRepublic

Collapse -

Locating a Stolen PC

by shmaltz In reply to Locating a Stolen PC

If there was a DHCP server on your network and it logs MAC address you may have some luck. Do the following:
1. If you remember an IP Address that used in the pass and you remember the date you used it get the MAC from the DHCP log and goto step 32. If you don't remember an IP Address or you don't remember a date: On exchange check the IP address of the last time you loged on using your old computer. From the DHCP log obtain the MAC address. Goto step 3
3. Ask your sysadmin if they can moniter the ports on their switches. If they can try obtaing the MAC address from the switch that way you will even know to which port it is plugged in. To narrow down your search check the DHCP log if that MAC is currently logged on. If your sysadmin doesn't want to moniter the Switch than at least check when the user is logged on on the DHCP server and try hunting thru the rooms (thru the subnet you should be able to narrow it down to specific floors/buildings).

Back to Security Forum
14 total posts (Page 1 of 2)   01 | 02   Next

Related Discussions

Related Forums