a forensic question

From: Doug Fox (dfox168@hotmail.com)
Date: 02/22/03 

From: "Doug Fox" <dfox168@hotmail.com>
Date: Sat, 22 Feb 2003 03:12:29 GMT

A user swore that she had powered down her NT 4.0 workstation before going
home. But she discovered that some important files on her workstation were
deleted this morning.

Checked:

The Event Viewer | Security Log, there was no entry as auditing was not
enabled.
The Event Viewer | System Log, the PC was powered down at 5:15 pm yesterday
and a DHCP request this morning. There was no activity in between these two
entries.
The Recyle Bin was empty.

Also checked //winnt/profiles directory. There was no unrecognizable
username.

Where else I can check for un-authorized access to this workstation? Could
it be "remote control" by a user with administrative priviledge? For
instance, net use //computername/c$. How can I find it out? From the
security log of the PDC?

Are there tools which help in-depth investigations?

Any pointers are appreciated.

Thanks,

Relevant Pages

  • a forensic question
    ... A user swore that she had powered down her NT 4.0 workstation before going ... The Event Viewer | Security Log, there was no entry as auditing was not ... The Event Viewer | System Log, the PC was powered down at 5:15 pm yesterday ...
    (comp.security.misc)
  • Re: a forensic question
    ... > A user swore that she had powered down her NT 4.0 workstation before going ... But she discovered that some important files on her workstation ... > The Event Viewer | Security Log, there was no entry as auditing was not ... > security log of the PDC? ...
    (microsoft.public.win2000.security)
  • Re: a forensic question
    ... > A user swore that she had powered down her NT 4.0 workstation before going ... But she discovered that some important files on her workstation ... > The Event Viewer | Security Log, there was no entry as auditing was not ... > security log of the PDC? ...
    (comp.security.misc)
  • Re: a forensic question
    ... the last 12 years that a user "swore the file was there" or "swore someone ... But she discovered that some important files on her workstation ... > The Event Viewer | Security Log, there was no entry as auditing was not ... > security log of the PDC? ...
    (comp.security.misc)
  • Re: workgroup is not accessable; the network is not present or not
    ... The workstation service terminated with service specific error 2250 ... Could not load RDR device driver ... not see any of the other machines on the network. ... > Have you used Event Viewer to see what events or error ...
    (microsoft.public.win2000.networking)