+ Post New Thread
Page 1 of 4 1234 LastLast
Results 1 to 15 of 57
General Chat Thread, Detective work - help in General; A memory stick has been found and after a bit of digging we worked out whos it is. It was ...
  1. #1

    Join Date
    Mar 2007
    Location
    Devon
    Posts
    1,042
    Thank Post
    226
    Thanked 63 Times in 56 Posts
    Rep Power
    30

    Detective work - help

    A memory stick has been found and after a bit of digging we worked out whos it is. It was also full of stuff that well isn't appropriate in a school so first course of action is to suspend him.

    Now the problem is he claims he lost it before half term and swears blind the stuff isn't his. His dad is very shcoked too as they run filters at home to block that kind of access, of course he could be using a proxy.

    But my question is is there any way of finding out more info than is displayed with pics, vids and folders as they all are saying they were created before he lost it. Are the dates on these correct or does it jsut relate to the date on the pc and could be "tricked" into thinking it's another date?

    Are there anyways of finding out pc name or anything from the files with some clever software?

  2. #2
    joe90bass's Avatar
    Join Date
    Oct 2007
    Location
    S Wales
    Posts
    1,354
    Thank Post
    327
    Thanked 107 Times in 96 Posts
    Rep Power
    51

    Re: Detective work - help

    There's not any 'genuine' work on there after the alledged lost date is there? Could help your case if there is.

    As for software I've not heard of any, sorry.

  3. #3
    Joanne's Avatar
    Join Date
    Nov 2007
    Location
    Lancashire
    Posts
    1,764
    Thank Post
    166
    Thanked 191 Times in 149 Posts
    Blog Entries
    17
    Rep Power
    87

    Re: Detective work - help

    get a memory stick and put some files on and then check the dates on that. I'm pretty sure it gives you the date of transfer, because when i backed up work on to my external and transferred it back, i got the transfer date...

    *gasp*

    or something!!

  4. #4

    Join Date
    Mar 2007
    Location
    Central Scotland
    Posts
    829
    Thank Post
    12
    Thanked 8 Times in 8 Posts
    Rep Power
    19

    Re: Detective work - help

    try restoring any deleted files on the memory stick? even if it fails it should indicate dates that they were last used etc.

    I get modified dates when I change anything and transfer dates when they're just copied. However if I copy an old file to my drive I get different modified, accessed and created dates.

  5. #5

    dhicks's Avatar
    Join Date
    Aug 2005
    Location
    Knightsbridge
    Posts
    5,664
    Thank Post
    1,263
    Thanked 786 Times in 683 Posts
    Rep Power
    237

    Re: Detective work - help

    > Now the problem is he claims he lost it before half term and swears blind
    > the stuff isn't his. His dad is very shcoked too as they run filters at home
    > to block that kind of access, of course he could be using a proxy.

    Or, the evidence would suggest, he could be bringing in / swapping dodgy files with his mates via memory stick at school.

    > But my question is is there any way of finding out more info than is
    > displayed with pics, vids and folders as they all are saying they were
    > created before he lost it. Are the dates on these correct or does it jsut
    > relate to the date on the pc and could be "tricked" into thinking it's
    > another date?

    There's nothing to stop a utility changing the created/modified/accessed times of a file, although I'd reckon it's unlikely that someone's gone to the trouble just for this pupil's USB drive.

    --
    David Hicks

  6. #6

    TechMonkey's Avatar
    Join Date
    Dec 2005
    Location
    South East
    Posts
    3,299
    Thank Post
    226
    Thanked 412 Times in 305 Posts
    Rep Power
    163

    Re: Detective work - help

    Depends on the files on there. If there are any recent office docs they should have an author or owner, if it is him or a family member name (from having a shared account at home) then he is lying, if it is just pics not alot you can do in that case. If you have data recover software (such as Bad Copy) it would be useful to run it on the stick to see what is there & if that sheds any light.

  7. #7

    Join Date
    Mar 2007
    Location
    Central Scotland
    Posts
    829
    Thank Post
    12
    Thanked 8 Times in 8 Posts
    Rep Power
    19

    Re: Detective work - help

    It might be worthwhile taking the filenames and running searches of pupil data on the server to see if anyone has them in their folders, unlikely but it is possible.

  8. #8


    tom_newton's Avatar
    Join Date
    Sep 2006
    Location
    Leeds
    Posts
    4,479
    Thank Post
    867
    Thanked 852 Times in 673 Posts
    Rep Power
    197

    Re: Detective work - help

    Have a look at that pupil's browsing history for the dates of some of the files - perhaps even export those dates and search for the filenames?

  9. #9
    mrforgetful's Avatar
    Join Date
    May 2006
    Posts
    1,639
    Thank Post
    7
    Thanked 15 Times in 15 Posts
    Rep Power
    23

    Re: Detective work - help

    If the file was copied then the Date Created will be the time it was put onto the memorystick.

    If the file was moved then the Date Created will be the time it was saved to it's original location.

    Not sure that helps at all.

  10. #10

    Join Date
    Mar 2007
    Location
    Devon
    Posts
    1,042
    Thank Post
    226
    Thanked 63 Times in 56 Posts
    Rep Power
    30

    Re: Detective work - help

    Thanks for the advice.

    None of the stuff was done during the school day which is nice but he does appear to have issues with a few other boys in his year who are more than capable of changing the pc's date then copying them to the memory stick.

    Running a file recovery there are hundreds of other images and vids that have been deleted so seems he is trying to pull a fast one.

  11. #11
    mrforgetful's Avatar
    Join Date
    May 2006
    Posts
    1,639
    Thank Post
    7
    Thanked 15 Times in 15 Posts
    Rep Power
    23

    Re: Detective work - help

    To be fair we have the policy:

    Your username, your equipment, your responsibility, your punishment.

  12. #12
    greenfieldsupport's Avatar
    Join Date
    Mar 2007
    Location
    Newton Aycliffe, Durham
    Posts
    240
    Thank Post
    14
    Thanked 3 Times in 3 Posts
    Rep Power
    16

    Re: Detective work - help

    Quote Originally Posted by Halfmad
    try restoring any deleted files on the memory stick? even if it fails it should indicate dates that they were last used etc.

    I get modified dates when I change anything and transfer dates when they're just copied. However if I copy an old file to my drive I get different modified, accessed and created dates.
    Yes use something like getdataback for FAT.

    you'll be able to see all the stuff thats been deleted off the disk aswell, provided the filesystem isnt totally shot, which it sounds like its not as you can see the files

    Also the created date is accurate providing the computer saving the file has its clock set correctly :P If the files were saved Before he said he lost it, the only defense he would have would be to say that his PC clock is set wrong, and if he has XP it would most likely synch from time.microsoft.com so he can shush and be told off :P

  13. #13
    greenfieldsupport's Avatar
    Join Date
    Mar 2007
    Location
    Newton Aycliffe, Durham
    Posts
    240
    Thank Post
    14
    Thanked 3 Times in 3 Posts
    Rep Power
    16

    Re: Detective work - help

    furthermore if u found it in school remember users dont have access rights to change the date of a PC to save things onto it...

    so they would have had to of taken it home, set the date back, copy said files, take the pen back to school and place it...

    Sounds like a plan too advanced for most of our students, the first thing one thinks of as a student is "DELETE IT AND USE IT FOR MYSELF!! or ... MELT ITTTT!!... or throw it off a bridge at car windows!"

    The whole conspiricy thing doesnt come to mind for them :P

  14. #14

    Michael's Avatar
    Join Date
    Dec 2005
    Location
    Birmingham
    Posts
    9,262
    Thank Post
    242
    Thanked 1,572 Times in 1,252 Posts
    Rep Power
    340

    Re: Detective work - help

    The one thing confuses me. If the memory stick just contained his school work, wouldn't any person (normally) report it missing or stolen? I know I would...

    I feel that the pupil in question realised he lost the memory stick, but of course wouldn't wish to report it due to the inappropriate content in addition to his school work. It makes sense really.

    The pupil has admitted it's his memory stick, only after you have done some investigative work.

    Verdict: guilty

  15. #15

    Join Date
    Mar 2007
    Location
    Devon
    Posts
    1,042
    Thank Post
    226
    Thanked 63 Times in 56 Posts
    Rep Power
    30

    Re: Detective work - help

    I'm with you guys i think he's guilty but the HM wanted to be sure before suspending him

SHARE:
+ Post New Thread
Page 1 of 4 1234 LastLast

Similar Threads

  1. "if you can't work with them, work round them"
    By djm968 in forum General Chat
    Replies: 45
    Last Post: 30th June 2008, 11:13 AM
  2. For those with too much work to do..
    By beeswax in forum BETT 2014
    Replies: 5
    Last Post: 6th November 2007, 09:56 PM
  3. On My Way to Work.....
    By BKGarry in forum General Chat
    Replies: 24
    Last Post: 16th October 2007, 02:22 PM
  4. Could it ever work
    By ITWombat in forum Blue Skies
    Replies: 9
    Last Post: 15th July 2007, 01:20 PM
  5. Replies: 17
    Last Post: 1st April 2006, 01:24 AM

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •