I've been wanting to create a dummy "Honeypot" user account on my Windows 7 laptop in case of theft.

My question is: Has anyone come across useful resources and tips for doing this? Is there a way to have what "looks" like an administrator account with lots of goodies but hides the real stuff; like a sandbox?

The main idea of this is to deter a thief from just reformatting the laptop right away. I imagine most thieves would boot up the laptop to see if anything interesting is going on, so having a user account with no password seems like a decent trap.

What I have been using so far is just a guest account with some interesting start up scripts that makes it easier for me to track the laptop and remote control it. Most tracking software I have looked at doesn't have the "sophistication" I'm looking for, and rolling my own seems like fun.

I know I left this question a bit general, but I'm looking for general suggestions and ideas.

3 Answers 3


Might there be some value in going the whole nine yards and instead of just having a dummy 'admin' account, using the hidden operating system functionality of truecrypt to run your own 'actaul' os thereby giving them the whole (unhidden) operating system to play with (which you have installed your tracking rootkit onto etc)? This way, you can really give them the impression of having gained access to somebody's private data (without having to mess around with faking much), install whatever rootkitesque tech you're going to for remote monitoring/control (maybe its just me but installing this kind of thing on my everyday os would make me nervous!) and be more sure of properly protecting your actual data.

  • interesting... I've used truecrypt before but I had no idea it could do that. That looks very useful.
    – WalterJ89
    Commented Mar 25, 2011 at 9:36
  • Of course you could accomplish something similar (if less covert) without truecrypt just by having a seperate os on another partition and having a bootloader for it on an external device.
    – TobyS
    Commented Mar 25, 2011 at 9:45
  • this may not work all that great because I use standby most of the time.
    – WalterJ89
    Commented Mar 25, 2011 at 10:30

My approach: Install Linux as my primary OS with full disk encryption, install Windows with a no-password default user.

Windows installation is left with the minimal: Firefox, Chrome, WinZip/WinRar, pdf reader, OpenOffice/LibreOffice, steam without account, Origin without account. This installation is to look like something just re-imaged, so the thief will not try to reformat the drive, and will just use everything that was installed.

And add a keylogger, VNC, Prey, DDNS client, a remote shell, and any invisible backdoor I can install and test. If someone steals it, it will keep using Windows and I can get a lot of data from it.


I suggest that you boot into the cloud with an OS that supports encrypted swap space and the ability to run a subsystem that always frees/secures vDRAM. Run all protocol traffic over Tor with obfsproxy, so as to hide the network signature that you are using Tor.

  • is this answer related to this question at all?
    – WalterJ89
    Commented Mar 28, 2011 at 9:35
  • Yes, the laptop is then a giant honeypot. Anything that a potential thief does to the machine will then be forensically available with no chance that the real owner had changed any of it.
    – atdre
    Commented Mar 29, 2011 at 20:00
  • still.. "boot into the cloud" I just find that phrase funny.
    – WalterJ89
    Commented Mar 30, 2011 at 21:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .