When geeks attack~

[2TONSSOFUN]

Way to go Chris! We could see you on 60 minutes

[sangerbanger58]

Nice get those thugs

[formare]

Great story - I find one piece of information confusing. How did you know the IP address? If you statically assigned the address the machine would not be able to conenct to wifi and even if it did it would not present itself with the machine ID but rather with WAN Router ID???? Never mind - just read the read teh piece about the RDP software you installed.

Originally Posted by Falundir

Thought you all may find this funny.

So I run a small Computer Forensics / eDiscovery consultancy based out of Dublin CA. We do a lot of work for Fortune 500 companies, law firms, the FBI, and local law enforcement.

My mother flew out here for the holidays, and for some odd reason decided to check her laptop in her luggage. Well as you can expect it didn't quite make it to the other side. After reporting it to the carrier and TSA the TSA Security Officer stated that it is a chronic problem and it's gone.

Well some time ago I had my mother install a piece of software that would allow me to interact with the system if she had issues. So I found the laptop online...

-By using the IP address I was able to locate the laptop within 3 city blocks.
-By looking at the available wi-fi connections, someone in the area listed their full name as their wi-fi... So in general you can assume that in a city sprawl the signal would not travel more than half a block.
-Turning the webcam on yielded some interesting pictures...

Let's see (images modified to avoid the legality of posting the suspect's identity)

The first one I saw... whoa ugly!



The next time I logged in... yup that's a kid in the bathroom...



om nom?



And then the important one!



So you can see the brick pattern of the house next to them in the window. Lets see what google maps has for us...



Looks like a match to me!

So I called the detective I was working with with the address information I located on google maps and provided him with the evidence I collected to date.

Hello officers!



Laptop was recovered an hour ago~

Today's lesson, don't steal a laptop from the mother of a forensic expert.

That is all.

P.S. To those who know the typical chain of events in a laptop recovery based on IP, you typically contact the ISP with a subpoena or search warrant and they have 7 days to respond unless it's a missing persons or child pornography case. We were able to gather this information before the ISP got back to us.


Update 1/7: From what was relayed to me from the detective on the case, the FBI has been investigating a theft ring in Chicago's Midway Airport for over a year now. Apparently 9 out of every 10 laptops that gets checked never makes it to the other side.

It seems that they were out of leads until this laptop was recovered, and now they are successfully tracing it back to the source and hopefully will make some arrests.

The quote from the detective I found funny was, 'yea you will probably see this on CBS/NBC soon'.

Since I've done work for the FBI before they have elected to let me do the forensic investigation, so the laptop is being shipped to me right now. I'll continue to update the thread as we go. I'm hoping the thief used it prior to selling it...

[Pain505]

i still think it is amazing what you did here. may i ask. do u love your job for the pay you get?

[Dr Jkel]

The wonderful world of technology........a criminal is born every minute.....I sure hope you catch whomever stole this.

[ebrogue]

Originally Posted by Falundir

Thought you all may find this funny.

So I run a small Computer Forensics / eDiscovery consultancy based out of Dublin CA. We do a lot of work for Fortune 500 companies, law firms, the FBI, and local law enforcement.

My mother flew out here for the holidays, and for some odd reason decided to check her laptop in her luggage. Well as you can expect it didn't quite make it to the other side. After reporting it to the carrier and TSA the TSA Security Officer stated that it is a chronic problem and it's gone.

Well some time ago I had my mother install a piece of software that would allow me to interact with the system if she had issues. So I found the laptop online...

-By using the IP address I was able to locate the laptop within 3 city blocks.
-By looking at the available wi-fi connections, someone in the area listed their full name as their wi-fi... So in general you can assume that in a city sprawl the signal would not travel more than half a block.
-Turning the webcam on yielded some interesting pictures...

Let's see (images modified to avoid the legality of posting the suspect's identity)

The first one I saw... whoa ugly!



The next time I logged in... yup that's a kid in the bathroom...



om nom?



And then the important one!



So you can see the brick pattern of the house next to them in the window. Lets see what google maps has for us...



Looks like a match to me!

So I called the detective I was working with with the address information I located on google maps and provided him with the evidence I collected to date.

Hello officers!



Laptop was recovered an hour ago~

Today's lesson, don't steal a laptop from the mother of a forensic expert.

That is all.

P.S. To those who know the typical chain of events in a laptop recovery based on IP, you typically contact the ISP with a subpoena or search warrant and they have 7 days to respond unless it's a missing persons or child pornography case. We were able to gather this information before the ISP got back to us.


Update 1/7: From what was relayed to me from the detective on the case, the FBI has been investigating a theft ring in Chicago's Midway Airport for over a year now. Apparently 9 out of every 10 laptops that gets checked never makes it to the other side.

It seems that they were out of leads until this laptop was recovered, and now they are successfully tracing it back to the source and hopefully will make some arrests.

The quote from the detective I found funny was, 'yea you will probably see this on CBS/NBC soon'.

Since I've done work for the FBI before they have elected to let me do the forensic investigation, so the laptop is being shipped to me right now. I'll continue to update the thread as we go. I'm hoping the thief used it prior to selling it...

If you ever find the thief, please let me know. I am still investigating the theft of my laptop from a Midway/Southwest employee from Sept. 2011. It's been a dead end at all points. Thanks!

[Revo1]

Nicely done!

[2010SSRSM6]

Awesome! My wife did a very similar job while she was with the state police back east. They had someone from about all the alphabet soup companies present. Only job she ever had that she wishes she wouldn't have left for grad school.


Sent from my iPhone using Tapatalk

[Falundir]

Originally Posted by Pain505

i still think it is amazing what you did here. may i ask. do u love your job for the pay you get?

I love what I do. A few years back I started my own consultancy which took off. It has me on the road for good percentage of the year, but I'm working on localizing to reduce travel here in the near future.

Originally Posted by Dr Jkel

The wonderful world of technology........a criminal is born every minute.....I sure hope you catch whomever stole this.

I was recently notified that as a result of this case, charges have been brought to 'a number of individuals'. To be honest I've been very busy and haven't had a chance to look into it. Once the laptop was recovered I let my mother take over non forensic communications with the police since it was her property.

Originally Posted by ebrogue

If you ever find the thief, please let me know. I am still investigating the theft of my laptop from a Midway/Southwest employee from Sept. 2011. It's been a dead end at all points. Thanks!

Feel free to PM or email me (csitter@cerberusforensics.com) your information and once I dig up the Detective's information again I will pass it along to you. There is a *chance* they seized additional laptops during the arrest.