Detective work - help

[dave.81]

A memory stick has been found and after a bit of digging we worked out whos it is. It was also full of stuff that well isn't appropriate in a school so first course of action is to suspend him.

 

Now the problem is he claims he lost it before half term and swears blind the stuff isn't his. His dad is very shcoked too as they run filters at home to block that kind of access, of course he could be using a proxy.

 

But my question is is there any way of finding out more info than is displayed with pics, vids and folders as they all are saying they were created before he lost it. Are the dates on these correct or does it jsut relate to the date on the pc and could be "tricked" into thinking it's another date?

 

Are there anyways of finding out pc name or anything from the files with some clever software?

[joe90bass]

There's not any 'genuine' work on there after the alledged lost date is there? Could help your case if there is.

 

As for software I've not heard of any, sorry.

[Joanne]

get a memory stick and put some files on and then check the dates on that. I'm pretty sure it gives you the date of transfer, because when i backed up work on to my external and transferred it back, i got the transfer date...

 

*gasp*

 

or something!!

[Halfmad]

try restoring any deleted files on the memory stick? even if it fails it should indicate dates that they were last used etc.

 

I get modified dates when I change anything and transfer dates when they're just copied. However if I copy an old file to my drive I get different modified, accessed and created dates.

[dhicks]

> Now the problem is he claims he lost it before half term and swears blind

> the stuff isn't his. His dad is very shcoked too as they run filters at home

> to block that kind of access, of course he could be using a proxy.

 

Or, the evidence would suggest, he could be bringing in / swapping dodgy files with his mates via memory stick at school.

 

> But my question is is there any way of finding out more info than is

> displayed with pics, vids and folders as they all are saying they were

> created before he lost it. Are the dates on these correct or does it jsut

> relate to the date on the pc and could be "tricked" into thinking it's

> another date?

 

There's nothing to stop a utility changing the created/modified/accessed times of a file, although I'd reckon it's unlikely that someone's gone to the trouble just for this pupil's USB drive.

 

--

David Hicks

[TechMonkey]

Depends on the files on there. If there are any recent office docs they should have an author or owner, if it is him or a family member name (from having a shared account at home) then he is lying, if it is just pics not alot you can do in that case. If you have data recover software (such as Bad Copy) it would be useful to run it on the stick to see what is there & if that sheds any light.

[Halfmad]

It might be worthwhile taking the filenames and running searches of pupil data on the server to see if anyone has them in their folders, unlikely but it is possible.

[tom_newton]

Have a look at that pupil's browsing history for the dates of some of the files - perhaps even export those dates and search for the filenames?

[mrforgetful]

If the file was copied then the Date Created will be the time it was put onto the memorystick.

 

If the file was moved then the Date Created will be the time it was saved to it's original location.

 

Not sure that helps at all.

[dave.81]

Thanks for the advice.

 

None of the stuff was done during the school day which is nice but he does appear to have issues with a few other boys in his year who are more than capable of changing the pc's date then copying them to the memory stick.

 

Running a file recovery there are hundreds of other images and vids that have been deleted so seems he is trying to pull a fast one.

[mrforgetful]

To be fair we have the policy:

 

Your username, your equipment, your responsibility, your punishment.

[greenfieldsupport]

try restoring any deleted files on the memory stick? even if it fails it should indicate dates that they were last used etc.

 

I get modified dates when I change anything and transfer dates when they're just copied. However if I copy an old file to my drive I get different modified, accessed and created dates.

 

Yes use something like getdataback for FAT.

 

you'll be able to see all the stuff thats been deleted off the disk aswell, provided the filesystem isnt totally shot, which it sounds like its not as you can see the files

 

Also the created date is accurate providing the computer saving the file has its clock set correctly If the files were saved Before he said he lost it, the only defense he would have would be to say that his PC clock is set wrong, and if he has XP it would most likely synch from time.microsoft.com so he can shush and be told off

[greenfieldsupport]

furthermore if u found it in school remember users dont have access rights to change the date of a PC to save things onto it...

 

so they would have had to of taken it home, set the date back, copy said files, take the pen back to school and place it...

 

Sounds like a plan too advanced for most of our students, the first thing one thinks of as a student is "DELETE IT AND USE IT FOR MYSELF!! or ... MELT ITTTT!!... or throw it off a bridge at car windows!"

 

The whole conspiricy thing doesnt come to mind for them

[Michael]

The one thing confuses me. If the memory stick just contained his school work, wouldn't any person (normally) report it missing or stolen? I know I would...

 

I feel that the pupil in question realised he lost the memory stick, but of course wouldn't wish to report it due to the inappropriate content in addition to his school work. It makes sense really.

 

The pupil has admitted it's his memory stick, only after you have done some investigative work.

 

Verdict: guilty

[dave.81]

I'm with you guys i think he's guilty but the HM wanted to be sure before suspending him

[Guest richard]

My motto is "guilty till they prove themselves innocent"

[dhicks]

> I'm with you guys i think he's guilty but the HM wanted to be sure

> before suspending him

 

Assuming that he is (like you say, seems likely), and assuming that he hasn't bypassed his home PC's filters, you might find you have several pupils swapping dodgy material between them. If you have an on-access virus scanner it might be an idea to create virus signatures from the files on the pupil's USB drive before you wipe it, that way you might be able to catch some of his co-conspirators copying the same files around.

 

--

David Hicks

[sunny_nunny]

We find that most instances of kids accessing dodgy material are when they go round to one of their mate's homes where the parents are totally clueless and let them have an unmonitored internet enabled pc up in their bedroom. They then copy all sorts of material on to their usb pens, ipods and phones. We once took out 11 kids who had distributed porn this way amongst themselves.

[mrforgetful]

I dont understand all this censorship. I had an unmonitored PC in my bedroom from when I was 14/15 and the internet had no rules back then, no age verification or anything.

 

I turned out alright.....

[TekkyMatt]

If you cant, beyond all reasonable doubt, poke holes in this kids alibi's or prove his story false then it would be totally unfair to punish him. Also, as long as whats on his stick is legal (I am assuming it is) then what business is it of the schools. Just dont allow USB drives.

[Guest richard]

If you cant, beyond all reasonable doubt, poke holes in this kids alibi's or prove his story false then it would be totally unfair to punish him. Also, as long as whats on his stick is legal (I am assuming it is) then what business is it of the schools. Just dont allow USB drives.

 

If you had taken time to read the OP he states that:

 

It was also full of stuff that well isn't appropriate in a school so first course of action is to suspend him.

 

So therefore the student has broken school rules and should be punished.

[PEO]

I would attempt to restore deleted files.

[enjay]

The one thing confuses me. If the memory stick just contained his school work, wouldn't any person (normally) report it missing or stolen? I know I would...

You'd think so, wouldn't you, but no. Our Librarian typically finds three-ish pen drives a week in her area, and I get another one every week or two in the IT Suites (I don't know why they are so much more forgetful in the Library).

 

Can I just throw in a curly one here. Since the pen drive belongs to the child and not the school, what rights did you have to go looking at its contents? Once you had identified its owner (and even that it dubious if challenged) you should have stopped looking at it. If someone had left their diary/day planner lying around, would you read all their appointments or just the front page with their name in it?

[Halfmad]

Nick I think the point is that that had to look at it to find out who's it was, they didn't find anything so they started asking around.

 

The instant it's plugged in or used on the school network as far as I'm concerned it's accessable by me and i'll check it for anything I want.

[mrforgetful]

I know it's possible using Computer Management to manually mount a USB stick as a folder in the C: drive.

 

Is it possible to make this process automatic?

 

*sorry for hijacking the thread, shall I start my own?