Laptop Theft – data compromised and logmein to the rescue

Recently a client experienced a laptop theft from their home.

This last happened to a client in 2008 when i wrote this blog article – once again, the theft was from home.

One other theft that I never wrote about was for a client who was traveling in Italy in a rented car. Somehow, the thieves managed to puncture the tyre and stole his bags from the boot while he was trying to deal with the punture.

In the the March 2011, the laptop in question was not password protected. However it was fully backed up with Carbonite (link on RHS).

What was a concern was the family photos and emails.

Fortunately we had logmein installed.

My colleagues and I monitored the logs to see if anyone would connect….

three days after the theft we got an IP address which was reported to the police

36 hours later and we saw the computer online. My colleague connected and monitored what the laptop was being used for.

During three hours of monitoring, we got screen shots which included:

1. a photograph of the user and family members on facebook

2. a full name and date of birth

3. two email addresses

4. various conversations

5. the language that the user spoke

6. We confirmed that the IP address was the same as 36 hours prior

All this information was obtained by watching and without any intervention. The data was passed on to the police.

Once the user stopped using the computer, we had a few minutes available to react. In juts five minutes my colleague:

1. Locked the keyboard with logmein

2. Created a user password for the Vista system

3. Deleted photos, emails and documents

4. Uninstalled Carbonite

5. Locked out the computer

This was a great result – it meant that the data was gone and that the laptop would most probably have to be completely wiped for it to be used again!




Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s

%d bloggers like this: