I have a D-link 600M router with a simple WPA2 password that got cracked. 60 Gb of data was downloaded (I think they downloaded torrent movies), which resulted in the renewal of my data plan. I searched for devices in the status of my WiFi router but found no results.
Is there is any way I can use forensic tools to find the devices which attached to my router? I'd like to know their MAC addresses to be able to catch the culprits.
Do WiFi routers log data about devices that are now disconnected? My router currently only shows those devices which are actively connected in the status window.