VERY IMPORTANT!!! Need to know every move made on PC!!!

[cmputrskillme]

Good God, one of my customers (and my family members rent from these people! :eek: ) ended up with some VERY disturbing pictures, and I mean DISTURBING on her computer. Accusations flew and the computer was brought to me.

I can tell dates and times on several of the pictures, however, there are more showing in the "recent documents" that originate from E:/mmm. Was this a thumbdrive or external drive? All say DESKTOP and E:/mmm.

Sensitive situation here...... so, is there a way for me to tell who did what and when? Can I tell when a thumb drive was hooked up, dates and times? Is there some kind of log that I can tell what was done for the past month? This was formatted on November 3rd, 2006 so I need to know all that was done since that date.

Thanks guys!

Sharon

[Reverend]

You should be able to right click the "recents" entries and view the dates via properties.

[phishhead]

then you can install a keylogger so you can see everything they do from now on.

[egghead]

clone the drive before yo mess with it so you won't erase or time stamp dates

[Big Booger]

clone the drive before yo mess with it so you won't erase or time stamp dates
:whs:
then you can install a keylogger so you can see everything they do from now on.
:whs:
You should be able to right click the "recents" entries and view the dates via properties.

:whs:

[Big Booger]

Also to contribute to this thread:

Click start, control panel, go into Administrator tools, under event viewer, select system log.

In that area, you should see a list of dates, times, etc... and the name of the device (or "removeable storage service") that connected to the machine.

I give you my own event viewer as proof:

Question: Is this disturbing enough to be illegal or is it just kinky sex?

[cash_site]

also check the history or recent file lists in Internet Explorer Browser or picture viewing programs such as Office Picture Manager.

[cmputrskillme]

Thanks guys for all of your help, I'm finding some stuff I needed for proof with a peice of software that recovers lost and deleted data. The system log was what I needed to check for the thumb drive hookup and external burner. Thanks VERY much!

And yes, BB, this is disturbing enough to be illegal. Wreckless to do on someone elses computer. They claim this boy was asked to install a printer and install some spyware software, but used it for much more before returning it to her. He had it between me and her, so, I have to prove that I didn't put the disgusting pictures on there and that the boy, in fact, did with dates, times and devices.

I don't know what she is going to do, I'm making sure my a$$ is covered, and to pray for the little victim in the two pictures I found.

Sharon

[Big Booger]

Thanks guys for all of your help, I'm finding some stuff I needed for proof with a peice of software that recovers lost and deleted data. The system log was what I needed to check for the thumb drive hookup and external burner. Thanks VERY much!

And yes, BB, this is disturbing enough to be illegal. Wreckless to do on someone elses computer. They claim this boy was asked to install a printer and install some spyware software, but used it for much more before returning it to her. He had it between me and her, so, I have to prove that I didn't put the disgusting pictures on there and that the boy, in fact, did with dates, times and devices.

I don't know what she is going to do, I'm making sure my a$$ is covered, and to pray for the little victim in the two pictures I found.

Sharon

CYA saves the day! Why would he be looking at nasty images on another person's computer? What a fool, and sicko.

[rik]

and obviously not as good a technician as He may believe.

[piaqt]

Send the local police the pix. If it's illegal, it's prosecutable. And maybe they can help the victims.