Software

Ask something
Question Locked

Tracking a users actions

0 helpful
4 replies

by mlong

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I have a user in my enterprise that has just been accused of a crime
against a child and I have been given the task of going through his
computer on a hunt to find if there is any "inappropriate" material on his
drive including Internet History. The files and such I can handle, but if
he's cleared out his browsing history, is there any way to get that back?
What is the easiest way to go about checking his internet history? I've
never had to do this before and any help would be fantastic.
He is using IE7 on his computer, OS is WinXP Pro w/ SP2 working in a
Domain environment.

Thanks...

4 replies

by cmiller5400

I would consult with an attorney on this one to find out what exactly your state requires. At a minimum you will need to do a forensic exam on it, which requires certain steps be taken such as, removing the hard drive from the machine, cloning it to make a master copy from which all copies are made (not just an image, but an actual sector by sector, bit by bit copy), sealing the original as evidence, then making a copy of the master copy to work with.

This probably should be left to a specialist due to laws and chains of evidence that must be protected in case something is found. Hopefully someone with more experience will be by to guide you better.

Edit: To add more information

by Former member

http://www.toolsthatwork.com/computer-forensic.htm

Also do this: Go into "computer" and click on the drive(s) and select "folder and search options" and select "view > show hidden files and folders". Hope this helps you.

Please post back if you have any more problems or questions.

by oh smeg

Even if it is for Unfair Dismissal don't proceed any further.

If you find something you will be accused of placing it there and as you have no qualifications in this side of the business without any legal backup you will be libel for any damages that are awarded against the Company or whoever.

Do not even remove the drive to send away for a proper Forensic investigation as it will be argued that you are responsible for whatever is found on the drive. With any Legal thing along these lines the Proper Authorities must seize the computer and examine it till they are satisfied. That way you are not responsible for anything found on the drive and provided that you have not touched the system on the day that the date stamp is for the offending files you are in the clear maybe. It really depends on what is found and how good the Lawyer defending this person is. They will pass the blame off onto others in the business who have had access to the computer and there is no way to protect yourself from this. But if you have had no contact with the system in question the Defense has to prove that you placed whatever there and not the person who uses the system.

As the authorities have not seized this computer I don't think that the alleged offense involved a computer but to protect yourself and company you need to consult the Companies Legal Adviser before proceeding any further.

Col

This discussion is closed to new replies.