dave20046 Posted January 21, 2009 Posted January 21, 2009 Right a kid at my school's shot someone and the plod want me to get everything he's done at school to scan for evidence. So far I've emptied his my docs from the server and given them the link to his bebo page but can anyone else think of anything? To get all his internet history and cookies will I have to retrieve them locally from the client machine he's used (fat chance)?
dave20046 Posted January 21, 2009 Author Posted January 21, 2009 the filtering and proxy is set externally by the ISP.
kmount Posted January 21, 2009 Posted January 21, 2009 Not an easy one unless you have either a proxy as DB suggested, or know which machines he's been using to check the cached profile (if there is one), or finally unless you redirect the history/cookies to a central location.
AndyD Posted January 21, 2009 Posted January 21, 2009 I had a child that had been searching for things he shouldn't have been and had to get the information locally. We do have ISA Server 2004 and would love to be able to get the information from there. I have only seen monitoring, is that what I need to use as I don't normally keep that running?
dave20046 Posted January 21, 2009 Author Posted January 21, 2009 Not an easy one unless you have either a proxy as DB suggested, or know which machines he's been using to check the cached profile (if there is one), or finally unless you redirect the history/cookies to a central location. No the history and cookies are left locally, I think what I'll have to do is enquire about the teachers and ask which machines he favoured and try and pick stuff up from there.
kmount Posted January 21, 2009 Posted January 21, 2009 (edited) In which case, IEHistoryViewer (here) will be invaluable to you. There are other means we can entertain to try and find where he's been if you have no joy. (How many PCs potentially could he has used (assuming all curricular)). Hope this helps. Edited January 21, 2009 by kmount Fixed link.
dave20046 Posted January 21, 2009 Author Posted January 21, 2009 I've never actually really looked into cookies, what information can I get from them and how? (that's more out of interest than anything else I'll most likely just pass the files onto the police to deal with)
dave20046 Posted January 21, 2009 Author Posted January 21, 2009 In which case, IEHistoryViewer (here[/url) will be invaluable to you. There are other means we can entertain to try and find where he's been if you have no joy. (How many PCs potentially could he has used (assuming all curricular)). Hope this helps. About 15 I would have thought, thanks a lot kmount
smadison Posted January 21, 2009 Posted January 21, 2009 copy your ISA Logs somewhere and try using excel get the data out of them.
alan-d Posted January 21, 2009 Posted January 21, 2009 As long as the index.dat file is intact then the police can use that to get all they want.
dave20046 Posted January 21, 2009 Author Posted January 21, 2009 As long as the index.dat file is intact then the police can use that to get all they want. yeah it should be, cheers
eduabncs Posted January 21, 2009 Posted January 21, 2009 As long as the index.dat file is intact then the police can use that to get all they want. Alan didn't you have somebody come in to your school a few years ago to use you school as a 'test school' for their forensic service, that covered this? I seem to also remember they also did an assembly with the kids discussing e-safety etc.
alan-d Posted January 22, 2009 Posted January 22, 2009 Alan didn't you have somebody come in to your school a few years ago to use you school as a 'test school' for their forensic service, that covered this? I seem to also remember they also did an assembly with the kids discussing e-safety etc. I did indeed The original thread is here http://www.edugeek.net/forums/windows/1873-f-o-all-ict-managers-technicians.html but the web site seems to be dead. Simon did visit us last year but we were just about to install Policy Central which made a lot of his work redundant in that it prevented site access whereas Simons solution was post event with the exception of the assemblies. I still have the results he put together. His user name is Mitch if anyone wants to pm him.
ArchersIT Posted January 22, 2009 Posted January 22, 2009 I had a child that had been searching for things he shouldn't have been and had to get the information locally. We do have ISA Server 2004 and would love to be able to get the information from there. I have only seen monitoring, is that what I need to use as I don't normally keep that running? If you have ISA server 2004 you can set ISA to log access. This is done on the logging tab within the monitoring section. Once this is done it will log to text files (by default). The can either be imported into excel (as someone else suggested) or if you know SQL you can use LogParser (free download from Microsoft) to run SQL like queries against those logs to pick out only the information you want. An example of a LogParser query (this one to retrieve all internet activity for a specific user specified as a parameter to a batch file) "C:\Program Files\Log Parser 2.2\logparser.exe" -i:w3c -o:w3c "select * into c:\isalogs\extract_people_all_20090122.txt from 'c:\Program Files\Microsoft ISA Server\ISALogs\ISALOG_20090122_WEB_000.w3c' where to_lowercase(cs-username) = to_lowercase('%SearchNames%') order by cs-username,date,time" I know that wont help you if you dont have ISA, but the AndyD asked how to do it with ISA. Cheers Jonathan 1
OutToLunch Posted January 22, 2009 Posted January 22, 2009 Right a kid at my school's shot someone and the plod want me to get everything he's done at school to scan for evidence. Seems odd - wouldn't the process of you collecting evidence for them totally taint it, render it inadmissible etc? Not the usual police forensics route!
glensc Posted January 22, 2009 Posted January 22, 2009 Seems odd - wouldn't the process of you collecting evidence for them totally taint it, render it inadmissible etc? Not the usual police forensics route! I agree I'd ask them to come and collect it with your assistance. This is as if they want to use any of it in court it's quite probably that a defending laywer would try to get the evidence declared inadmisable. They might just be trying to get something in which to pressurise a confession from the person though.
somabc Posted January 22, 2009 Posted January 22, 2009 Seems odd - wouldn't the process of you collecting evidence for them totally taint it, render it inadmissible etc? Not the usual police forensics route! Exactly FFS! If the police want to collect evidence then they can come and do it themselves. Unfortunately you might find they turn up with a Court Order and seize all the computers he could have used for a few months.
browolf Posted January 22, 2009 Posted January 22, 2009 ict classes ought to use seating plans so that the kids sit at the same pcs every lesson. I have log files generated at login so I know where every kid and teacher has sat every lesson for at least 6 months. you can use http://www.nirsoft.net/utils/ie_cache_viewer.html to read the contents of the dat file.
dave20046 Posted January 23, 2009 Author Posted January 23, 2009 Cheers guys, I've handed over his documents and said if they want anymoe then I'll have to go round his local machines. I'll see what they say.
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now