How to track a laptop after theft?

Question

Our company had a break-in this evening and a laptop was stolen. The data on the laptop was not super-sensitive (luckily); however, we would like to be able to track the laptop if at all possible.

The laptop is a Win7 x64 laptop, a newer Dell business model. There is no lojack software or anything of that nature pre-loaded on the laptop.

In this situation, what would some best first steps be, and do you know of any tricks that can be used to track or monitor a laptop after it has been stolen?

Answer 1

I think this video here will give you some ideas: What happens when you steal a hackers computer (Defcon 18). This is however a MAC PC, but it will give you some ideas.

Answer 2

I doubt there is much you can do with this, but your best bet is going to be watching logs of any services running on the laptop. If there is a mail account, you can watch the mail server logs to see the IP address, likewise for any other services.

Answer 3

One of those things that is easy if prepared in advance but very tricky after the fact. If the laptop has default VPN setup on it, or a default connection it would make to your network once plugged in, you may be able to get info, but more realistically you need to act as if it is a writeoff...and if it was unencrypted, plan for the fact that all the data on it may be used and abused.

Start to think about the response you need to make - are you in a jurisdiction where you need to tell clients whose data was on it? Have any accounts that the laptop may have logged into in the past had their passwords changed.

Sorry most of that was offtopic :-)

Answer 4

Well I'll point out some idea's for next time. It's a good idea to always have some sort or recovery plan in place. Some of these even make life a lot easier when you are working remotely too.

1. Running a Service like DynDNS is a good start to make a laptop easily accessible no matter where it is. It's easier than remembering or looking up the IP address.

2. Having a SSHd service running is great for taking control of the PC where ever it is or even deleting/recovering data remotely. For windows I like to use Cygwin but there are simpler set ups than that. (VNC is nice too)

3. Running a Virtual Private Network service like Neorouter or Hamachi or LogMein avoids port forwarding issues. (this is probably the most important one)

4. Of course none of this does any good if the bad guy can't get past the log in screen. So make sure you have guest account active or a hardened non-privileged account. (even a secondary OS works). Then run a trapdoor script in that account. Nothing in won if the stolen laptop is just reformatted.

5. Running a nasty trapdoor script at login is a nice touch. I have one that deletes or hides browser history, saved passwords, and anything sensitive (so on and so forth). Of course this last step is where the real fun begins.

Some things you can probably try and get that laptop back.

1. Check logs for email accounts

2. Check Facebook. I'll bet whoever stole the laptop tried it to see if you were still logged in. If you were then the IP address will be logged in Facebooks' security settings.

3. MSN Messenger, if auto login is enabled and the thief is abusing the account you can get the IP address by starting a file transfer or trying to start a video/audio conversation.

4. Any VPN software you may have running is the best bet.