Stolen Laptop & Teamviewer

Forums › Laptops and mobile computers › Stolen Laptop & Teamviewer

redherring

85 posts

Master Geek

#177491 4-Aug-2015 11:58

A client of mine had their laptop stolen a few weeks ago, and today I've noticed it popped up in my Teamviewer list as online.

I connected to it to get the IP address in Teamviewer logs, then I blanked the screen and disabled remote input. It looks like it was just restarted because it's back online again. Obviously its new owner isn't a geek.

Any advice or suggestions as to what we can / should do with it?

1 | 2

5288 posts

Uber Geek

#1358580 4-Aug-2015 12:00

Activate the camera. Take a photo of the thieves.

Get their ip address and report to the police who can get the account holder of the internet connection maybe.

Even if they do get caught, cops do little. They'll say they bought it off a mate and the worst they get done for is receiving. Slap on the hand and they are sent on their way.

taneb1

517 posts

Ultimate Geek

ID Verified

Trusted

Mercury

#1358581 4-Aug-2015 12:02

I'd suggest viewing the screen to see if you can get any details (Eg logging into Facebook, emails, etc), note this down/take screenshots
Note down the IP address and the time/dates it then pass all of this information onto the police
Would really suggest not messing with the computer/taking it to your own hands as would likely stop any information from being gathered/lose the laptop for good

If you can provide evidence of this being used (Such as screenshots, etc) then I would guess that can visit the property to try recover the laptop (As long as it was reported as stolen)

Any comments made are my personal views and does not represent those of my employer

macuser

2120 posts

Uber Geek

#1358584 4-Aug-2015 12:04

This is the best thing that could happen outside of the laptop not being stolen.

A) you're likely to find their details easily
B) the trill of the hunt

Keep us updated OP

freitasm

BDFL - Memuneh
79297 posts

Uber Geek

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#1358601 4-Aug-2015 12:24

I strongly recommend Prey Project for automating these tasks... But yes, get screenshots, IP address and go from there.

michaelmurfy

meow
13260 posts

Uber Geek

Moderator

ID Verified

Trusted

Lifetime subscriber

#1358638 4-Aug-2015 12:41

I've done several stolen laptop recoveries and have been successful with each one.

1) Blank the screen and install Prey when you don't detect mouse movement - you can get it from here: https://preyproject.com/ - I recommend looking at the automated deployment steps.
2) Put Prey into lost mode but keep Prey quiet - don't give it away!
3) using Teamviewer watch the desktop - you'll need to be quick to ensure it doesn't give them any clues you're watching. Screenshot any Facebook accounts or blank the screen and go to Facebook, check for any signed in users.
4) Patience, capture as much evidence as you can. Take photos with the webcam, take screenshots and when you've got a link between the person and an online account (with a name) keep this safe.
5) When you've got enough information (including wireless networks around, IP addresses and screenshots) pass this through to the police.

With one case I did write a notepad message onto a screen basically saying "This is a stolen laptop and we've got enough information to make an arrest - drop the laptop into "insert police station here" by tomorrow or the police will be called" - scree tactics often work especially if they're novice users. The person dropped this laptop into the police station within 30min from seeing that message.

Also be prepared for some filthy webcam images, pr0n on the screen and all that. I've had one person who had some images you really don't want to see on the laptop of which I screenshotted folders and passed this through to the police, words can't express how disgusting it was but this all depends on the person that has it, some people are total scum.

Good luck.

Michael Murphy | https://murfy.nz
Referral Links: Quic Broadband (use R122101E7CV7Q for free setup)

Are you happy with what you get from Geekzone? Please consider supporting us by subscribing.
Opinions are my own and not the views of my employer.

redherring

85 posts

Master Geek

#1358651 4-Aug-2015 12:57

Update:

Thanks for the suggestions everyone.

I now have a name, partner's name, Facebook profile, email address, location (same town as the theft), and screenshots.

The camera didn't work, it might be covered up, maybe the lid is closed.

I'm watching what looks like a Mission Impossible movie streaming from somewhere.

No one seems to have noticed that I'm connected yet.

Unfortunately they have disabled the original user accounts so I can't delete client data or mess with system settings.

freitasm

BDFL - Memuneh
79297 posts

Uber Geek

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#1358653 4-Aug-2015 12:58

That should be enough information to start visiting a police station...

Quic Broadband

Move to New Zealand's best fibre broadband service (affiliate link). Free setup code: R587125ERQ6VE. Note that to use Quic Broadband you must be comfortable with configuring your own router.

johnr

19282 posts

Uber Geek
Inactive user

#1358661 4-Aug-2015 13:19

redherring: Update:

Thanks for the suggestions everyone.

I now have a name, partner's name, Facebook profile, email address, location (same town as the theft), and screenshots.

The camera didn't work, it might be covered up, maybe the lid is closed.
I'm watching what looks like a Mission Impossible movie streaming from somewhere.

No one seems to have noticed that I'm connected yet.

Unfortunately they have disabled the original user accounts so I can't delete client data or mess with system settings.

That is awesome!

kiwifidget

"Cookie"
3423 posts

Uber Geek

Lifetime subscriber

#1358662 4-Aug-2015 13:24

freitasm: I strongly recommend Prey Project for automating these tasks... But yes, get screenshots, IP address and go from there.

Are you using Prey?
I have 3 devices that could benefit from this, one Win10 laptop (so hot right now!), an Android phone, and Android tablet.
Is the free basic plan sufficient or do you recommend one of the pay per month options?

Delete cookies?! Are you insane?!

freitasm

BDFL - Memuneh
79297 posts

Uber Geek

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#1358663 4-Aug-2015 13:25

I use Prey, the paid plan because we have nine devices being tracked...

redherring

85 posts

Master Geek

#1358677 4-Aug-2015 13:40

In every other case where this has happened to me, the computer never appears in Teamviewer - I assume most people would be smart enough to wipe everything and install a fresh OS before using it. Would Prey make any difference?

nathan

5695 posts

Uber Geek
Inactive user

#1358699 4-Aug-2015 14:06

redherring: In every other case where this has happened to me, the computer never appears in Teamviewer - I assume most people would be smart enough to wipe everything and install a fresh OS before using it. Would Prey make any difference?

you need something like Absolute LoJack for that

hashbrown

463 posts

Ultimate Geek

#1358935 4-Aug-2015 20:25

If you can, capture the output of the following

netsh wlan show network bssid

This will capture all the visible wifi SSIDs and BSSIDs. If you are lucky there might be a clue in the SSID names like a business or street name. Otherwise you can find a service that will geo-locate the BSSIDs

I believe prey does this now, but this might be stealthier. If you are going to use prey, make sure you research and practise doing a silent install, so you can drop it on there as quick as possible.

*NOTE* Not advocating a physical confrontation with whoever has the laptop, just another bit of evidence you could gather.

Good luck!

redherring

85 posts

Master Geek

#1360104 6-Aug-2015 16:08

UPDATE:

The laptop has been recovered. I don't have all the details, but the police told me yesterday they were making enquiries with the people involved, and today I got the call from the original owner who has just picked it up.

As you can imagine, I'm fairly stoked right now.

Thank you for all the advice :)

wasabi2k

2096 posts

Uber Geek

#1360115 6-Aug-2015 16:17

congrats man - good story.

Good to see the police followed it up.

1 | 2