+ Post New Thread
Page 1 of 2 12 LastLast
Results 1 to 15 of 21
Internet Related/Filtering/Firewall Thread, Recovering All a students files & internet history in Technical; Right a kid at my school's shot someone and the plod want me to get everything he's done at school ...
  1. #1

    Join Date
    Jan 2009
    Location
    leicestershire
    Posts
    59
    Thank Post
    7
    Thanked 2 Times in 1 Post
    Rep Power
    12

    Recovering All a students files & internet history

    Right a kid at my school's shot someone and the plod want me to get everything he's done at school to scan for evidence. So far I've emptied his my docs from the server and given them the link to his bebo page but can anyone else think of anything? To get all his internet history and cookies will I have to retrieve them locally from the client machine he's used (fat chance)?

  2. #2

    Dos_Box's Avatar
    Join Date
    Jun 2005
    Location
    Preston, Lancashire
    Posts
    10,464
    Thank Post
    605
    Thanked 2,186 Times in 1,004 Posts
    Blog Entries
    23
    Rep Power
    632
    No proxy\ISA server?

  3. #3

    Join Date
    Jan 2009
    Location
    leicestershire
    Posts
    59
    Thank Post
    7
    Thanked 2 Times in 1 Post
    Rep Power
    12
    the filtering and proxy is set externally by the ISP.

  4. #4


    Join Date
    Feb 2007
    Location
    Northamptonshire
    Posts
    4,692
    Thank Post
    352
    Thanked 797 Times in 716 Posts
    Rep Power
    347
    Not an easy one unless you have either a proxy as DB suggested, or know which machines he's been using to check the cached profile (if there is one), or finally unless you redirect the history/cookies to a central location.

  5. #5

    Join Date
    May 2008
    Posts
    56
    Thank Post
    33
    Thanked 3 Times in 3 Posts
    Rep Power
    13
    I had a child that had been searching for things he shouldn't have been and had to get the information locally. We do have ISA Server 2004 and would love to be able to get the information from there. I have only seen monitoring, is that what I need to use as I don't normally keep that running?

  6. #6

    Join Date
    Jan 2009
    Location
    leicestershire
    Posts
    59
    Thank Post
    7
    Thanked 2 Times in 1 Post
    Rep Power
    12
    Quote Originally Posted by kmount View Post
    Not an easy one unless you have either a proxy as DB suggested, or know which machines he's been using to check the cached profile (if there is one), or finally unless you redirect the history/cookies to a central location.
    No the history and cookies are left locally, I think what I'll have to do is enquire about the teachers and ask which machines he favoured and try and pick stuff up from there.

  7. #7


    Join Date
    Feb 2007
    Location
    Northamptonshire
    Posts
    4,692
    Thank Post
    352
    Thanked 797 Times in 716 Posts
    Rep Power
    347
    In which case, IEHistoryViewer (here) will be invaluable to you.

    There are other means we can entertain to try and find where he's been if you have no joy. (How many PCs potentially could he has used (assuming all curricular)).

    Hope this helps.
    Last edited by kmount; 21st January 2009 at 06:03 PM. Reason: Fixed link.

  8. #8

    Join Date
    Jan 2009
    Location
    leicestershire
    Posts
    59
    Thank Post
    7
    Thanked 2 Times in 1 Post
    Rep Power
    12
    I've never actually really looked into cookies, what information can I get from them and how? (that's more out of interest than anything else I'll most likely just pass the files onto the police to deal with)

  9. #9

    Join Date
    Jan 2009
    Location
    leicestershire
    Posts
    59
    Thank Post
    7
    Thanked 2 Times in 1 Post
    Rep Power
    12
    Quote Originally Posted by kmount View Post
    In which case, IEHistoryViewer ([url=http://www.nirsoft.net/utils/iehv.html]here[/url) will be invaluable to you.

    There are other means we can entertain to try and find where he's been if you have no joy. (How many PCs potentially could he has used (assuming all curricular)).

    Hope this helps.
    About 15 I would have thought, thanks a lot kmount

  10. #10
    smadison's Avatar
    Join Date
    Sep 2007
    Location
    UK
    Posts
    100
    Thank Post
    2
    Thanked 30 Times in 25 Posts
    Rep Power
    20
    copy your ISA Logs somewhere and try using excel get the data out of them.

  11. #11

    Join Date
    Jan 2009
    Location
    leicestershire
    Posts
    59
    Thank Post
    7
    Thanked 2 Times in 1 Post
    Rep Power
    12
    I don't think I have an ISA server

  12. #12
    alan-d's Avatar
    Join Date
    Aug 2005
    Location
    Sutton Coldfield
    Posts
    2,414
    Thank Post
    360
    Thanked 256 Times in 187 Posts
    Rep Power
    75
    As long as the index.dat file is intact then the police can use that to get all they want.

  13. #13

    Join Date
    Jan 2009
    Location
    leicestershire
    Posts
    59
    Thank Post
    7
    Thanked 2 Times in 1 Post
    Rep Power
    12
    Quote Originally Posted by alan-d View Post
    As long as the index.dat file is intact then the police can use that to get all they want.
    yeah it should be, cheers

  14. #14
    eduabncs's Avatar
    Join Date
    Aug 2005
    Location
    somewhere in the midlands
    Posts
    394
    Thank Post
    31
    Thanked 21 Times in 19 Posts
    Rep Power
    28

    Question

    Quote Originally Posted by alan-d View Post
    As long as the index.dat file is intact then the police can use that to get all they want.
    Alan didn't you have somebody come in to your school a few years ago to use you school as a 'test school' for their forensic service, that covered this? I seem to also remember they also did an assembly with the kids discussing e-safety etc.

  15. #15
    alan-d's Avatar
    Join Date
    Aug 2005
    Location
    Sutton Coldfield
    Posts
    2,414
    Thank Post
    360
    Thanked 256 Times in 187 Posts
    Rep Power
    75
    Quote Originally Posted by eduabncs View Post
    Alan didn't you have somebody come in to your school a few years ago to use you school as a 'test school' for their forensic service, that covered this? I seem to also remember they also did an assembly with the kids discussing e-safety etc.
    I did indeed The original thread is here F.A.O. All ICT Managers / Technicians

    but the web site seems to be dead. Simon did visit us last year but we were just about to install Policy Central which made a lot of his work redundant in that it prevented site access whereas Simons solution was post event with the exception of the assemblies. I still have the results he put together.

    His user name is Mitch if anyone wants to pm him.

SHARE:
+ Post New Thread
Page 1 of 2 12 LastLast

Similar Threads

  1. Internet History.
    By Daleus in forum Windows
    Replies: 7
    Last Post: 2nd December 2008, 02:55 PM
  2. Recovering Deleted Files...
    By Pumaedition in forum Windows
    Replies: 3
    Last Post: 16th October 2007, 08:41 AM
  3. Internet explorer & AVI files
    By nickje in forum Windows
    Replies: 7
    Last Post: 12th October 2006, 11:14 AM
  4. Recovering Files From a Corrupt Floppy
    By Preston in forum Windows
    Replies: 15
    Last Post: 27th April 2006, 03:39 PM
  5. Recovering Deleted Files
    By Pear in forum Windows
    Replies: 13
    Last Post: 21st February 2006, 07:49 PM

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •