I am curious to gain some thoughts from you all about a security issue we had here a few months back. To make a long story short, we had one of our company laptops “disappear” due to bad management and check-in/check-out policies. Then this machine reappears in the same place it should have been a year later.
The system is older, and has no security put in place ..etc it was never apart of a domain ..etc In addition there were no login requirements.
I have a good idea of which employee had this machine during this period now comes the time to proove my suspictions. When going through this machine what can I use to verify that this person had the machine.
There were some documents created/modified which appear to belong to the suspect however how can this be made to stick if anyone could change date ..etc 🙂 other ideas? tips?
Thanks!
