Re: Internal Hacker

From: Dmitry Kulshitsky (dimkin(remove)@mbox.com.au)
Date: 10/17/02 

From: "Dmitry Kulshitsky" <dimkin(remove)@mbox.com.au>
Date: Thu, 17 Oct 2002 15:27:28 +1000

Karl made the excellent review of what you could do.
Also I'd like to share some thoughts.
In addition to checking temporary folders you can check the list
of last opened documents in excel itself and also in the
Start -> Documents folder. User could just forget about cleaning this list
of last used files. Also recently cleared list can take your attention as
well too.

"Dan" <hecar50@hotmail.com> wrote in message
news:467901c2754b$c3320f30$36ef2ecf@tkmsftngxa12...
> I had a situation & am looking for help.
>
> An employee at my site got into a secure user directory
> and posted sensitive information on a public drive on our
> network. They also printed a copy & placed it on a
> manger's desk.
>
> We are currently on NT 4.0 Server. The application log &
> system log have a week of entries deleted(the week of the
> incident) and the security log was deleted entirely.
>
> These were Excel spreadsheets that were comprimised. I
> found one still on the network & know the date, time &
> name of user to last save it.
>
> Several questions? Does the name in the properties of the
> excel file just tell the login that was used?
>
> We do not have a print server setup, so I can't check that
> either.
>
> Looking for suggestions to try to trace what user did this.
> Any idea's and/or suggestions would be greatly appreciated.
>
>

Quantcast