Forensic

[lionsl2005]

hi ,

in a computer how can i document the user visited web pages? i checked the browser history while user logged on, he visited some un authorised sites. as a local computer administrator how to document the evidence? visited time, date, site address etc, firefox doesnt seem to have property potion to see the actual visited history date and time. please help

[dalsoth]

We use specific software to do this sort of thing on school machines. You can find many proxy or cache box machines that will do this. Also things like Securus and Impero and RM Smartcache/Auditor can monitor what websites a user visits in great detail.

 

Not sure how good internet explorer or firefox history logs are.

[russdev]

hi ,

in a computer how can i document the user visited web pages? i checked the browser history while user logged on, he visited some un authorised sites. as a local computer administrator how to document the evidence? visited time, date, site address etc, firefox doesnt seem to have property potion to see the actual visited history date and time. please help

 

If of serious nature and work for LA then stop pull power cable (don't shut down) then inform head and LA.

 

As anything else and you might ruin any legal case you should not do any of investigation work yourself.

 

Russ

[lionsl2005]

If of serious nature and work for LA then stop pull power cable (don't shut down) then inform head and LA.

 

As anything else and you might ruin any legal case you should not do any of investigation work yourself.

 

Russ

 

hmmm i can remember my forensics evidence study in my uni.

[kmount]

If of serious nature and work for LA then stop pull power cable (don't shut down) then inform head and LA.

 

As anything else and you might ruin any legal case you should not do any of investigation work yourself.

 

Russ

 

Sorry to disagree Russ but if of a serious nature involving the police police/ceop DO NOT turn the machine off the third party will come to you. Our county AUP (and our own internally adapted version) specifically details steps to take in events such as this which includes the above and you're welcome to a copy for advice.

 

If your investigation is more for inappropriate usage ie. accessing games during work time or something then IEHistoryviewer can look at the user profile and pull off where and when they've visited sites.

[russdev]

hmmm i can remember my forensics evidence study in my uni.

 

@kmount depends on la some say leave it on and some say pull the power.

 

@lionsl2005

 

Dosn't matter really as you would still upset the legal case as you would not be able to be an expert in court (unless forensics is what you do for living in which case ignore me even if have studied it).

 

If non-serious then ignore this

[kmount]

Russ, fair enough.

 

Horses for courses I suppose.

[russdev]

p.s

 

In non serious case still inform the head before looking at the laptop otherwise could get yourself into legal hot water (even if you think you have a water tight AUP).

[kmount]

I misread, and didn't see Firefox, you'll want MozillaHistoryView instead.

 

Depending upon what sparked the investigation will depend upon how you play it as Russ said.

 

It's unclear whether you're investigating a member of staff or a student therefore your action plan steps may be different.

 

For students we act on our own initiative and prepare a report as per our AUP which goes to the Head of House, and eSafety leader for action. Our Head is only involved if it is a serious issue as she's far too busy for several reports a week on internet misuse by students hence the appointment of an eSafety leader on the SLT. - Our intention once the AUP is fully ratified at governing body level will be to have a reporting means back to the Head/SLT/Governoring body regularly to ensure the correct attention and focus is given.

 

Please do post again lionsl2005 as I think what you're doing could be useful for many more people in our shoes.