This is a pretty amazing story about a stolen laptop and how it led to the arrest of a dangerous criminal accused of drive-by shootings and a possible murder. If it weren’t for the proactive approach taken by an IT professional, this guy might still be on the loose, committing more crimes and causing more havoc in his community.
A few weeks ago I wrote about the cost of a lost or stolen laptop, as well as various means to help recover the devices. In today’s article, I have a pretty amazing story about a stolen laptop and how it led to the arrest of a dangerous criminal accused of drive-by shootings and a possible murder. If it weren’t for the proactive approach taken by an IT professional, this guy might still be on the loose, committing more crimes and causing more havoc in his community.
The story starts with Greg Hemig, CEO of Capital Computer Guys in northern California. Hemig’s company specializes in remotely managing computers for small businesses in and around Stockton and Sacramento. His company uses Kaseya IT Managed Services software to provide full PC management services from a central location.
Laptop Losers Hall of Shame
Kaseya’s automated scripts allow Capital Computer Guys to update and patch computers, scan for viruses and malware, deploy new software and much more. And as you’ll soon see, Kaseya’s scripting and remote control capabilities are incredibly useful tools in the stolen laptop recovery process.
Capital Computer Guys, with the help of a Kaseya engineer, developed a “stolen laptop” script. Hemig recognized the need for such a tool after one of his customer’s computer was stolen and they didn’t have everything in place to track it down. They knew Kaseya had this capability, so they wrote the scripts in anticipation of other situations — and it paid off big time.
The script is meant to execute as soon as a stolen PC connects to the Internet. The Kaseya software starts gathering all sorts of information like the IP address the PC is connecting from, the time that it comes online, the Web sites it visits, and so on. This information is put into a log and sent back to the central console monitored by Capital Computer Guys. The script also activates a keystroke logger, an audio recorder, a Webcam (if present on the PC), and — most importantly — a data retrieval process. Since the data on the PC is likely to be more valuable than the PC itself, it’s critical to recover the data and then wipe the hard disk clean to prevent unauthorized access to the data.
And then it happened. A laptop belonging to one of Hemig’s customers was stolen. Hemig waited to see if the computer would connect to the Internet and phone home. Sure enough, a few days after the theft Hemig got an alert on his cell phone: the laptop was online and the game was on. Hemig went to his Kaseya console and watched the story unfold as the script started executing.
First, the data was retrieved via FTP, placed on a safe server and then removed from the laptop. Once the data was secure, the script disabled the antivirus software. This would allow the keystroke logger to run. In addition, the script hid the fact that the Kaseya software was remotely accessing the PC so as not to raise suspicions from the alleged thief. Then, Hemig sat back and watched.
Through the console, he could see what was happening in near real time. He watched the person visit a social networking site, and this yielded her name. Hemig learned her street address from other online activity. After a few days, he had enough information to know precisely where the PC was and who had it. He took the information to the police and expected immediate action.
Instead he was met with skepticism. The detective didn’t understand how all this evidence was gathered, and didn’t know if it was legal or not. The officer worried about needing a warrant to confront the person who now possessed the PC. Meanwhile, Hemig continued to gather even more data about the stolen laptop. He had a purchase receipt to prove the computer belonged to his client. The serial number Kaseya gathered from the PC matched the number on the receipt. There was no doubt that the PC didn’t belong to the person using it.
Eventually the detective simply took Hemig’s evidence, went to the woman’s house, confronted her about the laptop and recovered it from her. It turns out she had purchased it from someone, and she gave the seller’s name and whereabouts to the police. A quick check showed that the police had been searching for this man; he was wanted for other thefts. They tracked him down, arrested him and recovered some of the other stolen goods.
Then the incredible happened. This laptop thief confessed to drive-by shootings, one of which included a possible murder. The police now had sufficient evidence to hold him for prosecution and a lengthy prison sentence if convicted.
The detective on this case personally called Hemig to thank him for his role in tracking down the criminal. For his part, Hemig was happy to have recovered the computer for his client, but especially delighted that all his amateur detective work led to such an important outcome.
What is your company doing about a “stolen laptop” script? The odds say you may need it someday.
