+ Post New Thread
Page 1 of 4 1234 LastLast
Results 1 to 15 of 57
General Chat Thread, Detective work - help in General; A memory stick has been found and after a bit of digging we worked out whos it is. It was ...
  1. #1

    Join Date
    Mar 2007
    Location
    Devon
    Posts
    1,042
    Thank Post
    226
    Thanked 63 Times in 56 Posts
    Rep Power
    29

    Detective work - help

    A memory stick has been found and after a bit of digging we worked out whos it is. It was also full of stuff that well isn't appropriate in a school so first course of action is to suspend him.

    Now the problem is he claims he lost it before half term and swears blind the stuff isn't his. His dad is very shcoked too as they run filters at home to block that kind of access, of course he could be using a proxy.

    But my question is is there any way of finding out more info than is displayed with pics, vids and folders as they all are saying they were created before he lost it. Are the dates on these correct or does it jsut relate to the date on the pc and could be "tricked" into thinking it's another date?

    Are there anyways of finding out pc name or anything from the files with some clever software?

  2. #2
    joe90bass's Avatar
    Join Date
    Oct 2007
    Location
    S Wales
    Posts
    1,349
    Thank Post
    322
    Thanked 107 Times in 96 Posts
    Rep Power
    50

    Re: Detective work - help

    There's not any 'genuine' work on there after the alledged lost date is there? Could help your case if there is.

    As for software I've not heard of any, sorry.

  3. #3
    Joanne's Avatar
    Join Date
    Nov 2007
    Location
    Lancashire
    Posts
    1,504
    Thank Post
    116
    Thanked 112 Times in 104 Posts
    Blog Entries
    17
    Rep Power
    74

    Re: Detective work - help

    get a memory stick and put some files on and then check the dates on that. I'm pretty sure it gives you the date of transfer, because when i backed up work on to my external and transferred it back, i got the transfer date...

    *gasp*

    or something!!

  4. #4

    Join Date
    Mar 2007
    Location
    Central Scotland
    Posts
    829
    Thank Post
    12
    Thanked 8 Times in 8 Posts
    Rep Power
    18

    Re: Detective work - help

    try restoring any deleted files on the memory stick? even if it fails it should indicate dates that they were last used etc.

    I get modified dates when I change anything and transfer dates when they're just copied. However if I copy an old file to my drive I get different modified, accessed and created dates.

  5. #5

    dhicks's Avatar
    Join Date
    Aug 2005
    Location
    Knightsbridge
    Posts
    5,622
    Thank Post
    1,240
    Thanked 777 Times in 674 Posts
    Rep Power
    235

    Re: Detective work - help

    > Now the problem is he claims he lost it before half term and swears blind
    > the stuff isn't his. His dad is very shcoked too as they run filters at home
    > to block that kind of access, of course he could be using a proxy.

    Or, the evidence would suggest, he could be bringing in / swapping dodgy files with his mates via memory stick at school.

    > But my question is is there any way of finding out more info than is
    > displayed with pics, vids and folders as they all are saying they were
    > created before he lost it. Are the dates on these correct or does it jsut
    > relate to the date on the pc and could be "tricked" into thinking it's
    > another date?

    There's nothing to stop a utility changing the created/modified/accessed times of a file, although I'd reckon it's unlikely that someone's gone to the trouble just for this pupil's USB drive.

    --
    David Hicks

  6. #6

    TechMonkey's Avatar
    Join Date
    Dec 2005
    Location
    South East
    Posts
    3,286
    Thank Post
    225
    Thanked 405 Times in 302 Posts
    Rep Power
    162

    Re: Detective work - help

    Depends on the files on there. If there are any recent office docs they should have an author or owner, if it is him or a family member name (from having a shared account at home) then he is lying, if it is just pics not alot you can do in that case. If you have data recover software (such as Bad Copy) it would be useful to run it on the stick to see what is there & if that sheds any light.

  7. #7

    Join Date
    Mar 2007
    Location
    Central Scotland
    Posts
    829
    Thank Post
    12
    Thanked 8 Times in 8 Posts
    Rep Power
    18

    Re: Detective work - help

    It might be worthwhile taking the filenames and running searches of pupil data on the server to see if anyone has them in their folders, unlikely but it is possible.

  8. #8


    tom_newton's Avatar
    Join Date
    Sep 2006
    Location
    Leeds
    Posts
    4,463
    Thank Post
    866
    Thanked 845 Times in 667 Posts
    Rep Power
    195

    Re: Detective work - help

    Have a look at that pupil's browsing history for the dates of some of the files - perhaps even export those dates and search for the filenames?

  9. #9
    mrforgetful's Avatar
    Join Date
    May 2006
    Posts
    1,637
    Thank Post
    7
    Thanked 15 Times in 15 Posts
    Rep Power
    22

    Re: Detective work - help

    If the file was copied then the Date Created will be the time it was put onto the memorystick.

    If the file was moved then the Date Created will be the time it was saved to it's original location.

    Not sure that helps at all.

  10. #10

    Join Date
    Mar 2007
    Location
    Devon
    Posts
    1,042
    Thank Post
    226
    Thanked 63 Times in 56 Posts
    Rep Power
    29

    Re: Detective work - help

    Thanks for the advice.

    None of the stuff was done during the school day which is nice but he does appear to have issues with a few other boys in his year who are more than capable of changing the pc's date then copying them to the memory stick.

    Running a file recovery there are hundreds of other images and vids that have been deleted so seems he is trying to pull a fast one.

  11. #11
    mrforgetful's Avatar
    Join Date
    May 2006
    Posts
    1,637
    Thank Post
    7
    Thanked 15 Times in 15 Posts
    Rep Power
    22

    Re: Detective work - help

    To be fair we have the policy:

    Your username, your equipment, your responsibility, your punishment.

  12. #12
    greenfieldsupport's Avatar
    Join Date
    Mar 2007
    Location
    Newton Aycliffe, Durham
    Posts
    240
    Thank Post
    14
    Thanked 3 Times in 3 Posts
    Rep Power
    15

    Re: Detective work - help

    Quote Originally Posted by Halfmad
    try restoring any deleted files on the memory stick? even if it fails it should indicate dates that they were last used etc.

    I get modified dates when I change anything and transfer dates when they're just copied. However if I copy an old file to my drive I get different modified, accessed and created dates.
    Yes use something like getdataback for FAT.

    you'll be able to see all the stuff thats been deleted off the disk aswell, provided the filesystem isnt totally shot, which it sounds like its not as you can see the files

    Also the created date is accurate providing the computer saving the file has its clock set correctly :P If the files were saved Before he said he lost it, the only defense he would have would be to say that his PC clock is set wrong, and if he has XP it would most likely synch from time.microsoft.com so he can shush and be told off :P

  13. #13
    greenfieldsupport's Avatar
    Join Date
    Mar 2007
    Location
    Newton Aycliffe, Durham
    Posts
    240
    Thank Post
    14
    Thanked 3 Times in 3 Posts
    Rep Power
    15

    Re: Detective work - help

    furthermore if u found it in school remember users dont have access rights to change the date of a PC to save things onto it...

    so they would have had to of taken it home, set the date back, copy said files, take the pen back to school and place it...

    Sounds like a plan too advanced for most of our students, the first thing one thinks of as a student is "DELETE IT AND USE IT FOR MYSELF!! or ... MELT ITTTT!!... or throw it off a bridge at car windows!"

    The whole conspiricy thing doesnt come to mind for them :P

  14. #14

    Michael's Avatar
    Join Date
    Dec 2005
    Location
    Birmingham
    Posts
    9,262
    Thank Post
    242
    Thanked 1,568 Times in 1,250 Posts
    Rep Power
    340

    Re: Detective work - help

    The one thing confuses me. If the memory stick just contained his school work, wouldn't any person (normally) report it missing or stolen? I know I would...

    I feel that the pupil in question realised he lost the memory stick, but of course wouldn't wish to report it due to the inappropriate content in addition to his school work. It makes sense really.

    The pupil has admitted it's his memory stick, only after you have done some investigative work.

    Verdict: guilty

  15. #15

    Join Date
    Mar 2007
    Location
    Devon
    Posts
    1,042
    Thank Post
    226
    Thanked 63 Times in 56 Posts
    Rep Power
    29

    Re: Detective work - help

    I'm with you guys i think he's guilty but the HM wanted to be sure before suspending him

SHARE:
+ Post New Thread
Page 1 of 4 1234 LastLast

Similar Threads

  1. "if you can't work with them, work round them"
    By djm968 in forum General Chat
    Replies: 45
    Last Post: 30th June 2008, 11:13 AM
  2. For those with too much work to do..
    By beeswax in forum BETT 2014
    Replies: 5
    Last Post: 6th November 2007, 09:56 PM
  3. On My Way to Work.....
    By BKGarry in forum General Chat
    Replies: 24
    Last Post: 16th October 2007, 02:22 PM
  4. Could it ever work
    By ITWombat in forum Blue Skies
    Replies: 9
    Last Post: 15th July 2007, 01:20 PM
  5. Replies: 17
    Last Post: 1st April 2006, 01:24 AM

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •