We have a computer we are investigating for abuse. There are 15 power users assigned to this computer. One of the workers accessed her pictures folder and called her supervisor right away - there were pornographic pictures that she did not have the day before. She's never seen them before. Is there a way for us to tell where the files originated - i.e. floppy, cd, flash drive, internet, etc.? Thanks for your help!
Tek-Tips is the largest IT community on the Internet today!
Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!
-
Congratulations strongm on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!
PICTURES UNDER EVERY SCREEN NAME
- Thread starter cmhdover
- Start date
if you have accessed any one of the pictures, you have already compromised the file(s).
if the machine is on a server, check the user logon logs for the machine and print them out from the last time this person looked at the pictures folder.
STOP ALL ACTIVITY ON THE MACHINE
your choices are to either give it to a forensics expert OR continue at your own risk of further contaminating the hard drive and hurting your legal chances of either finding the person(s) that placed them there or keeping your company from getting hit with a lawsuit for not maintaining an acceptable workplace.
whatever you have already done must be documented and your legal department needs to become involved.
the rest is better left for what decisions your company makes next.
i am not a lawyer and do not play one on TV so this information is worth what you have paid for it.
seriously though good luck.
if the machine is on a server, check the user logon logs for the machine and print them out from the last time this person looked at the pictures folder.
STOP ALL ACTIVITY ON THE MACHINE
your choices are to either give it to a forensics expert OR continue at your own risk of further contaminating the hard drive and hurting your legal chances of either finding the person(s) that placed them there or keeping your company from getting hit with a lawsuit for not maintaining an acceptable workplace.
whatever you have already done must be documented and your legal department needs to become involved.
the rest is better left for what decisions your company makes next.
i am not a lawyer and do not play one on TV so this information is worth what you have paid for it.
seriously though good luck.
Infinity306
IS-IT--Management
Well hopefully you at least stayed at a Holiday Inn Express???? if not, Uhh ohh.. LOL
Agree with eyec here-make sure your logs are up to date and don't do anything with the machine-not even looking/using it. Best thing would be to have an expert take a dd of the drives and work on an image. Then lock the machine away-especially if legal are going to be called in.
Once you have the image, you may want to look at the file metadata to determine who the owner is. True, this information could have been altered, but if the file was untouched since the day it was created there may be an indication to who they belonged to.
If you are in a Windows environment and have object auditing enabled, you may have the necessary information in the security logs you need. I would say, there is a low likelihood of having file auditing turned on for someone's picture folder, but you never know.
Also, if you couldn't determine this time, you could make sure that permissions are appropriately set on your filesystems, which would limit one's ability to repudiate ownership.
Ethan
If you are in a Windows environment and have object auditing enabled, you may have the necessary information in the security logs you need. I would say, there is a low likelihood of having file auditing turned on for someone's picture folder, but you never know.
Also, if you couldn't determine this time, you could make sure that permissions are appropriately set on your filesystems, which would limit one's ability to repudiate ownership.
Ethan
- Status
Similar threads
- Locked
- Question
- Locked
- Question
- Locked
- Question