Geekzone: technology news, blogs, forums
Guest
Welcome Guest.
You haven't logged in yet. If you don't have an account you can register now.




75 posts

Master Geek


# 177491 4-Aug-2015 11:58
Send private message

A client of mine had their laptop stolen a few weeks ago, and today I've noticed it popped up in my Teamviewer list as online.

I connected to it to get the IP address in Teamviewer logs, then I blanked the screen and disabled remote input. It looks like it was just restarted because it's back online again. Obviously its new owner isn't a geek.

Any advice or suggestions as to what we can / should do with it?





Filter this topic showing only the reply marked as answer View this topic in a long page with up to 500 replies per page Create new topic
 1 | 2
4339 posts

Uber Geek


  # 1358580 4-Aug-2015 12:00
One person supports this post
Send private message

Activate the camera. Take a photo of the thieves. 

Get their ip address and report to the police who can get the account holder of the internet connection maybe. 

Even if they do get caught, cops do little.  They'll say they bought it off a mate and the worst they get done for is receiving. Slap on the hand and they are sent on their way. 





383 posts

Ultimate Geek

Trusted
Trustpower

  # 1358581 4-Aug-2015 12:02
One person supports this post
Send private message

I'd suggest viewing the screen to see if you can get any details (Eg logging into Facebook, emails, etc), note this down/take screenshots
Note down the IP address and the time/dates it then pass all of this information onto the police
Would really suggest not messing with the computer/taking it to your own hands as would likely stop any information from being gathered/lose the laptop for good

If you can provide evidence of this being used (Such as screenshots, etc) then I would guess that can visit the property to try recover the laptop (As long as it was reported as stolen)




Any comments made are my personal views and does not represent those of my employer


 
 
 
 


2120 posts

Uber Geek


  # 1358584 4-Aug-2015 12:04
2 people support this post
Send private message

This is the best thing that could happen outside of the laptop not being stolen.  

A) you're likely to find their details easily
B) the trill of the hunt

Keep us updated OP

Mr Snotty
8830 posts

Uber Geek

Moderator
Trusted
Lifetime subscriber

  # 1358638 4-Aug-2015 12:41
2 people support this post
Send private message

I've done several stolen laptop recoveries and have been successful with each one.

1) Blank the screen and install Prey when you don't detect mouse movement - you can get it from here: https://preyproject.com/ - I recommend looking at the automated deployment steps.
2) Put Prey into lost mode but keep Prey quiet - don't give it away!
3) using Teamviewer watch the desktop - you'll need to be quick to ensure it doesn't give them any clues you're watching. Screenshot any Facebook accounts or blank the screen and go to Facebook, check for any signed in users.
4) Patience, capture as much evidence as you can. Take photos with the webcam, take screenshots and when you've got a link between the person and an online account (with a name) keep this safe.
5) When you've got enough information (including wireless networks around, IP addresses and screenshots) pass this through to the police.

With one case I did write a notepad message onto a screen basically saying "This is a stolen laptop and we've got enough information to make an arrest - drop the laptop into "insert police station here" by tomorrow or the police will be called" - scree tactics often work especially if they're novice users. The person dropped this laptop into the police station within 30min from seeing that message.

Also be prepared for some filthy webcam images, pr0n on the screen and all that. I've had one person who had some images you really don't want to see on the laptop of which I screenshotted folders and passed this through to the police, words can't express how disgusting it was but this all depends on the person that has it, some people are total scum.

Good luck.






75 posts

Master Geek


# 1358651 4-Aug-2015 12:57
2 people support this post
Send private message

Update:

 

 

Thanks for the suggestions everyone.

 

 

I now have a name, partner's name, Facebook profile, email address, location (same town as the theft), and screenshots.

 

 

The camera didn't work, it might be covered up, maybe the lid is closed.

 

I'm watching what looks like a Mission Impossible movie streaming from somewhere.

 

 

No one seems to have noticed that I'm connected yet.

 

 

Unfortunately they have disabled the original user accounts so I can't delete client data or mess with system settings.

 

 

 


 
 
 
 


19282 posts

Uber Geek
Inactive user


  # 1358661 4-Aug-2015 13:19
Send private message

redherring: Update:

Thanks for the suggestions everyone.

I now have a name, partner's name, Facebook profile, email address, location (same town as the theft), and screenshots.

The camera didn't work, it might be covered up, maybe the lid is closed.
I'm watching what looks like a Mission Impossible movie streaming from somewhere.

No one seems to have noticed that I'm connected yet.

Unfortunately they have disabled the original user accounts so I can't delete client data or mess with system settings.




That is awesome!

1708 posts

Uber Geek

Lifetime subscriber

  # 1358662 4-Aug-2015 13:24
Send private message

freitasm: I strongly recommend Prey Project for automating these tasks... But yes, get screenshots, IP address and go from there.

Are you using Prey?
I have 3 devices that could benefit from this, one Win10 laptop (so hot right now!), an Android phone, and Android tablet.
Is the free basic plan sufficient or do you recommend one of the pay per month options?





Life is too short to remove USB safely.




75 posts

Master Geek


  # 1358677 4-Aug-2015 13:40
Send private message

In every other case where this has happened to me, the computer never appears in Teamviewer - I assume most people would be smart enough to wipe everything and install a fresh OS before using it. Would Prey make any difference?

 


5147 posts

Uber Geek

Trusted
Microsoft

  # 1358699 4-Aug-2015 14:06
Send private message

redherring: In every other case where this has happened to me, the computer never appears in Teamviewer - I assume most people would be smart enough to wipe everything and install a fresh OS before using it. Would Prey make any difference?


you need something like Absolute LoJack for that

463 posts

Ultimate Geek


  # 1358935 4-Aug-2015 20:25
2 people support this post
Send private message

If you can, capture the output of the following

netsh wlan show network bssid

This will capture all the visible wifi SSIDs and BSSIDs.  If you are lucky there might be a clue in the SSID names like a business or street name.  Otherwise you can find a service that will geo-locate the BSSIDs

I believe prey does this now, but this might be stealthier.  If you are going to use prey, make sure you research and practise doing a silent install, so you can drop it on there as quick as possible.

*NOTE* Not advocating a physical confrontation with whoever has the laptop, just another bit of evidence you could gather.

Good luck!



75 posts

Master Geek


  # 1360104 6-Aug-2015 16:08
6 people support this post
Send private message

UPDATE:

 

 

The laptop has been recovered. I don't have all the details, but the police told me yesterday they were making enquiries with the people involved, and today I got the call from the original owner who has just picked it up.

 

 

As you can imagine, I'm fairly stoked right now.

 

 

Thank you for all the advice :)

2091 posts

Uber Geek


  # 1360115 6-Aug-2015 16:17
One person supports this post
Send private message

congrats man - good story.

Good to see the police followed it up.

 1 | 2
Filter this topic showing only the reply marked as answer View this topic in a long page with up to 500 replies per page Create new topic



Twitter and LinkedIn »



Follow us to receive Twitter updates when new discussions are posted in our forums:



Follow us to receive Twitter updates when news items and blogs are posted in our frontpage:



Follow us to receive Twitter updates when tech item prices are listed in our price comparison site:





News »

Facebook Portal to land in New Zealand
Posted 19-Sep-2019 18:35


Amazon Studios announces New Zealand as location for its upcoming series based on The Lord of the Rings
Posted 18-Sep-2019 17:24


The Warehouse chooses Elasticsearch service
Posted 18-Sep-2019 13:55


Voyager upgrades core network to 100Gbit
Posted 18-Sep-2019 13:52


Streaming service Acorn TV launches in New Zealand with selection with British shows
Posted 18-Sep-2019 08:55


Bitcoin.com announces partnership with smartphone manufacturer HTC
Posted 16-Sep-2019 21:30


Finalists Announced for Microsoft NZ Partner Awards
Posted 16-Sep-2019 19:37


OPPO Showcases New CameraX Capabilities at Google Developer Days China 2019
Posted 15-Sep-2019 12:42


New Zealand PC Market returns to growth
Posted 15-Sep-2019 12:24


Home sensor charity director speaks about the preventable death which drives her to push for healthy homes
Posted 11-Sep-2019 08:46


Te ao Maori Minecraft world set to inspire Kiwi students
Posted 11-Sep-2019 08:43


Research reveals The Power of Games in New Zealand
Posted 11-Sep-2019 08:40


Ring Door View Cam now available in New Zealand
Posted 11-Sep-2019 08:38


Vodafone NZ to create X Squad
Posted 10-Sep-2019 10:25


Huawei nova 5T to be available 20th September
Posted 5-Sep-2019 11:55



Geekzone Live »

Try automatic live updates from Geekzone directly in your browser, without refreshing the page, with Geekzone Live now.


Support Geekzone »

Our community of supporters help make Geekzone possible. Click the button below to join them.

Support Geezone on PressPatron



Are you subscribed to our RSS feed? You can download the latest headlines and summaries from our stories directly to your computer or smartphone by using a feed reader.

Alternatively, you can receive a daily email with Geekzone updates.