Hello,

I need some help, I'm an admin at a school and I have network reports of a key logger on the network. Now, I've narrowed it down to 12 nodes.

Another aspect to take into consideration is that there is a specific user on the network who has the Key Logger installation program in his personal folder and says that he was hacked awhile back and this file was planted there. This user has been used in the past to find security holes and is extremely knowlegable on networks and security. Though, he claims he didnt plant the logger.

My final question is---> How do we locate the user who DID plant this logger? Keep in mind that there are 12 nodes with keylogger data on them, NOT including the node that the user previously mentioned works on.

PLEASE HELP
SANDMAN