Fiction author needing help with research question...please...

More reality check?

1. If you are a sole practicioner, the only things you enter into your PIM are the unusual ones. You actually know when you are going on vacation? and so does your receptionist/secretary. You only enter stuff that you might forget like once off appointments, the dentist, vet, and that sort of thing?

If you were talking a 500 partner law or CPA practice it would be different; but not so here?

You only keep details of work done, because that is billable, and taxable ............ it is also history?

2. Psychiatrists don't do housecalls It is office, prison, hospital............... very predictable, and the consulting hours are on the shingle outside the office.

3. Penetration testing "expert"............ installs what on the computer?............ no removeable hard drive and butterfly cabinet?........... no strong encryption of data?.................... the only penetration testing he should be involved in should involve a Colt .45ACP!!!!........... actually I think that the Speer 485Gr SJSWC is very sexy :D

Oh Well, up to you :)

Quote:

---

Stick to the keylogger and forget Wireshark and StealthAudit (those are network tools and you got a standalone). Keyloggers generate log files

---

Keylogger wont log a live cd............


MLF

There are lots of ways to make this scene a lot more complicated then it really needs to be.

There truly are. But for a fictional purpose, and because I am sure Sam wants to keep the action moving, and not get bogged down into a technical dialog, keeping it as simply as possible is probably the best choice. Especially because her target readers are most likely not as technical as the AO crowd is.

My personal experience is that small to medium sized hospital tend toward lotus notes, and the small doc in a box office that are connecting to them are using a VPN configured by the hospital IT staff, or Outlook. But for the one or two doc shops, some use Outlook, but I was somewhat surprized to see how many of them use ACT! for a contact mananger/PIM.

Getting back to my point is a round about way, not a single one of these shops would guess someone had access their computers, unless it was while they had stepped out of the room, and came back and found the desktop or screen different. But over a weekend? Nah. They wouldnt even know to look for any differences.

If they DID happen to think someone had accessed their system, they are more likely to call a local computer shop. Their express area of interest would be PATIENT RECORDS not they PIM. They would only really care about that if the information was lost or altered, OR is they might be held liable for it. Seriously thou. I cant think of a single person in the health care field that wouldnt just miss completely that someone had rebooted their computer/server with a LiveCD. As long as everything worked when they came back into the office Monday, they would never have a reason to check the logs.

Cheers!

OK, just something to add, Sam, and I hope this doesn't throw to big a wrench into things. Osiris is a package that can be used like TripWire on a Windows box to check for changes to files. This is an ideal tool for standalones that you want to protect. Google that for a bit more detail, but the non-technical side is that it could have been installed by the boyfriend.

Boyfriend, penetration expert. Now, doesn't that equate to, like, 99 percent of boyfriends?
;)

Hey Rapier57

you forgot SEXY penetration expert.....

the sexy is VERY a important skill and job requirement ;)

MLF

He-heh, I had a client once for whom I was using grc.com's web scan, explaining it probes her (network) ports.

She sighed, and said it'd been awhile since anyone probed her ports.

I got some good hours in on that job. :p

Yeehaw!

Hey Sommersby,

It's been hinted at already, but I think your solution may require a little lateral thinking. While everyone is talking about the merits/demerits of various operating systems/applications etc. -- and this is understandable given you asked for technical advice -- how about looking at it differently?

e.g. something happens to the protagonist whereby the only possible explanation for someone being there/that thing happening at that time, is that someone has read their diary?

- that way they know someone's been at their machine, but they don't need to know how.

Perhaps...

cheers,

Vaughan.

I haven't read all the posts but I know a lot of non technical people tend to just turn off the screen at night and not lock the computer. If this was the case in your book the petaganist could just break into the office turn on the screen and find the computer not locked. They open the addresse book and meeting calender but get disturbed and just turn off the screen without closing the different programes as they leave. Your doctor can then come by the next day and either realise right away that someone had been looking at his appointments or he can realise it later when something happens. As i said this I havent read all the other posts so some one may have already suggested this.

My word, this is getting complex.

Just a suggestion...

Bad guy turns on PC & opens outlook (or other mail client) to examine calendar & then to save the contatcs to a usb keydrive.

However, while he's doing this, unbeknowst as it were, outlook dials in & downloads some email...

Bad guy shuts down.

Psych finds office broken into, contatcs his security expert, who upon checking (with the modem disconnected just in case) find downloaded email dated after the last time the Psych used the computer & then investigates further....

Finds a recent driver change in the registry pointing to a new usb keydrive being used in the timescale of the email & puts 2 & 2 together...

Simple but effective.

Drop me a pm sommersby if you want more details.

Steve