Remote Forensics

[IKnowNot]

I am no expert on any of this, but some things really stuck out and begged comment.

we have been told that an associate of ours has porn on his computer. ... if this came out it could be very harmful for the company i work for. the director asked me if i can get evidence of porn on his computer.

...he holds a franchise. i think its calif. and is not on our network ... but im under the impression that we just need resonable suspicion to find him in breech of his contract and it is stated that we have full access to the info on his computer.

I believe you are treading on very thin ice here and your director has handed you a 500 lbs. sack to carry across it; alone.

Key phrases here:
" porn " .....................What type? i.e., blatantly illegal, such as child porn, or soft porn, hard porn, what?

" on his computer " ...to what extent do you control what may be contained on a computer that you do not own and is " not on our network " ?

" im under the impression that we just need resonable suspicion to find him in breech of his contract " ........... You had better consult with the attorneys here. If you are about to attack a person's reputation, and/or a business's as the case here, along with future earning potentials, you had better base it on more then just suspicion, reasonable or otherwise.

" it is stated that we have full access to the info on his computer." stated by whom? And where is it stated? Obviously you have access to the computers, but to what extent? Total control? Or just to maintain compliance with antivirus, OS, and cooperate software updates?

And a very key phrase here:
" ... if this came out it could be very harmful for the company " This, in of itself, although a key monetary motivating factor is not, repeat not, a reason to tromp on the rights of others ( although a lot of people, especially politicians, would disagree privately if it suited their needs. )

Two other things really bothered me:

" we have been told that ..." By whom? Where did this information come from? An anonymous source? A disgruntled ex-employee? Was this source in any way in a position to have knowledge of this information?

" our biz is remedial tutoring and some of it is inolved with the 'no child left behind' " Red flags flying here, especially when mixed with a term like "porn." Anyone who does not know about this, check out

No Child LEFT BEHIND

but be prepared for a lot of study! My head still spinning, and I have been exposed to this for other reasons since it's inception.

Because of the nature of this I believe, in general, hogfly has probably supplied the best advise. I believe in this case you have been placed between a rock and a hard place. Consultation with the attorneys ( though I loathe lawyers they are sometimes a necessary evil ) before proceeding is mandatory.

You may find that the course directed to you by your director may put you in violation of criminal computer ( electronic ) and/or civil law.

My best wishes, may the force be with you on this one!

[Tedob1]

thank you all VERY much for your replys.

i havn't hearn anything on it since it went of to legal. the reason it did is because i insisted that what they wanted to do is a fellony. they said it wasn't...they dont think,but they better check with the begals (legal)


hogfly. as i said earlier im not a programmer. the find::file isn't a problem. the problem arose for me in trying to read files in random named directories to the file for transport in perl. the only way i could think of to do it was with the dos for command...though i might as well do the rest that way, but as it turns out under winXP the bat file becomes visible even though the perl program runs hidden. this problem wasn' there in 2k so im going to have to finnish it in strictly perl.

this project will be finished even if it doesn't get used so ill post the source and a link to the exe incase anyone wants it. ill include an ie scan too and use argv to input the ftpserver addy so you wont be sending it to mine.



IKnowNot

in a situation like ours it doesn't really matter what type of porn it is...porn around kids is porn.

[i2c]

Hey does he have google desktop installed already? if he does your can easily bend this to be network accesible, its just a thought and its likely he doesnt have it - just thinking out loud..

i2c