Please Help, Stolen laptop but I have LogMeIn installed

richiek

Apologies for double post, I had this posted in the Computers & Tech section (mods please feel free to remove whichever thread you find unnecessary) but also posted here after advice from another boardsie.

Hello all,

I am writing here in the hope that some kind souls can help me.

I moved to Berlin in January, my flat was broken into last month and all of our (mine and my girlfriends) stuff was taken including 2 laptops, SLR camera, ps3. psp, nintendo DS.

I had logmein installed on both my old toshiba laptop and my girlfriends macbook pro.

thankfully the person who bought the laptop hasn't formatted the hard drive so I still have remote access from logmein, we have been keeping logs of all the IP addresses used and using the file manager to recover photos

now that we have all our important info back off the laptop I've also been copying browser history and more recently been copying the mobileSync backup folder. so it appears that the person has an iPhone.

The police have been unbelievably good to us and have raided 2 locations already (thanks to the IP addresses), unfortunately nothing has turned up yet.

I was hoping I could help the detectives more by extracting more useful information from the laptop, i cant install a keylogger and I cant seem to find a facebook profile for the person either. but I was hoping I could extract the iPhone tracking data and map out where the person is and their patterns.

we have an address from the iPhone backup that we're 99% sure is his home address and we also have the iphone IMEI number and mobile number, we have a rough location of where he works too.

could anyone give me some advice as to how to get the tracking data from the iphone maybe how to get his text message backup also.

and if anyone could think of some other valuable information we might be able to get I would be eternally grateful.

Sorry for the long winded post, but hopefully someone can help!

thank you for reading,

all the best

Richie

dlofnep

I don't know anything about phones unfortunately, but do you have an e-mail address for the person in question from their cookies?

Kur4mA

richiek wrote: »

thankfully the person who bought the laptop hasn't formatted the hard drive so I still have remote access from logmein, we have been keeping logs of all the IP addresses used and using the file manager to recover photos

Errr, bought the laptop?

richiek wrote:

I was hoping I could help the detectives more by extracting more useful information from the laptop, i cant install a keylogger and I cant seem to find a facebook profile for the person either. but I was hoping I could extract the iPhone tracking data and map out where the person is and their patterns.

we have an address from the iPhone backup that we're 99% sure is his home address and we also have the iphone IMEI number and mobile number, we have a rough location of where he works too.

could anyone give me some advice as to how to get the tracking data from the iphone maybe how to get his text message backup also.

and if anyone could think of some other valuable information we might be able to get I would be eternally grateful.

Sorry for the long winded post, but hopefully someone can help!

So you have what you're 99% sure is his home address as well as his mobile phone number and IMEI number, yet you don't feel this is enough for the detectives to make an arrest? With that information, they can easily contact the guys mobile provider and get all the information they need.

syklops

Any chance you could find the mac address of their wireless router?

If so, you can use the tool here to get the location:

http://samy.pl/androidmap/

Ill login later and explain more if you want.

richiek

Cheers syklops,

I actually have a picture of the back of his router with the wifi address and password, will have a look now and see if the mac address is on there too.

@kyub,
I probably should have been clearer. Our flat was robbed but the stuff was sold on and offloaded, so I have the details of the person who currently has the laptop / bought it off the thief

and yes The IMEI home address and phone number should be plenty of info for the police to go on, but the info has to be presented to a lawyer and a judge first before they can subpoena information or obtain a search warrant.

I would like to have as much information as possible so that its easier and faster for the police to cut through the beurocracy and legalities. I could just as easily round some friends up and go take the stuff back, but the police have been very good so far and I'd rather not get into trouble myself too.


@ dlofnep

I have several email addresses, but its tricky to figure out which his primary address is, it looks like it could be a yahoo mail account.

xaoifsx

i'm actually amazed how people can track their laptops etc now... i wouldnt have a clue on how to do it!!
it seems that you have done a pretty good job now on tracking your laptops richie..i wouldnt be able to get that far!

richiek

cheers xaoifsx, I cant take all the credit, my girlfriend has been a super fast learner too and has done pretty much all the data extraction. Its been a case of using the logmein file manager and downloading certain files that would have sensitive information or at least some sort of identifiable material.

we've also been able to get some GPS tags from the pictures we managed to get off the iphone.

but keep watching this space, I'll keep people updated with the progress.

Thanks again for all the suggestions and support!

dlofnep

If you've copied his temp internet files/cookies - if you want to zip them up and send them on to me, I'll see what I can find for you. I'm a ruthless google-whore.

richiek

HA thats not a bad idea dlofnep, I'm at work at the moment, but will try get the cookies and send them on to you

ah how I love boards.ie

dlofnep

Good man I'll send you on my e-mail address in a PM. I'll do my best to track them down for you. By the way - Does your laptop have a cam built in? Might be able to use the snapshot facility remotely.

LoLth

just be careful.

If you are copying another person's private files and folders, even if its from stolen property, then you are invading their privacy - and they could be innocent in all of this.

if you are using logmein to gain access to a laptop where there is disputed ownership you *could* possibly be leavign yourself open to "hacking" charges - as in unauthorised access to a remote computer - especially one that is normally protected by a password.

Additionally, unless you are an officer of the law, nearly anyhtign you discover on your own cannot be verified and may be deemded inadmissable in a court of law as the chain of custody of the evidence is not clear and there is almost no way to say that it has not been tampered with.

ideally,
1. Dont go sending other people any personal information you may have uncovered
2. Give the police your logmein access detail and let them do the legwork following accepted police procedures for gathering and storing evidence (computer forensics)
3. check to see if cookies are "personal data". I think they are - I know IP addresses are under discussion as personal information - hence ISPs cant hand out your IP address history without a court order.
4. do not access any online data that is password protected (if you get the password from memory or a text file etc). that is definitely breach of privacy.

Yes, you can argue that the person that bought the laptop doesnt deserve their privacy if it helps you get your stuff back. But consider this:

they might have bought it not knowing it was stolen. We've all bought second hand bargains in the past. The buyer probably just thinks the seller is an idiot for leaving all the photos and stuff on it.

Would you be happy if you discovered someone was spying on your internet activity / reading your documents/email etc because they thought you might be involved with a crime? What if they weren't even law enforcement officers?

Think of the chain of evidence custody. Any opposing legal / lawyer type will argue that it *could* have been tampered with. Onyl law enforcement officers , or those acting on their behalf, can swear to the condition of evidence and maintain the chain of evidence.

I'm not a legal type person so I could be wrong with the above. However, I have studied a bit and off the top of my head, those are the things that I can think of. You dont want to find the guy that stole your stuff and then end up havign to sell it all off to pay for the fine you get in the civil case brought against you by the person you eavesdropped upon to gather the necessary information.

Also, even if you only use the data to work out where the current owner lives. How is a police officer suppoed to explain how they knew where to look?

dlofnep

LoLTh's advice is probably best.

LoLth

dlofnep wrote: »

LoLTh's advice is probably best.

I'll sort you out with that €5 later mate...

richiek

LoLth wrote: »

just be careful.

If you are copying another person's private files and folders, even if its from stolen property, then you are invading their privacy - and they could be innocent in all of this.

if you are using logmein to gain access to a laptop where there is disputed ownership you *could* possibly be leavign yourself open to "hacking" charges - as in unauthorised access to a remote computer - especially one that is normally protected by a password.

Additionally, unless you are an officer of the law, nearly anyhtign you discover on your own cannot be verified and may be deemded inadmissable in a court of law as the chain of custody of the evidence is not clear and there is almost no way to say that it has not been tampered with.

ideally,
1. Dont go sending other people any personal information you may have uncovered
2. Give the police your logmein access detail and let them do the legwork following accepted police procedures for gathering and storing evidence (computer forensics)
3. check to see if cookies are "personal data". I think they are - I know IP addresses are under discussion as personal information - hence ISPs cant hand out your IP address history without a court order.
4. do not access any online data that is password protected (if you get the password from memory or a text file etc). that is definitely breach of privacy.

Yes, you can argue that the person that bought the laptop doesnt deserve their privacy if it helps you get your stuff back. But consider this:

they might have bought it not knowing it was stolen. We've all bought second hand bargains in the past. The buyer probably just thinks the seller is an idiot for leaving all the photos and stuff on it.

Would you be happy if you discovered someone was spying on your internet activity / reading your documents/email etc because they thought you might be involved with a crime? What if they weren't even law enforcement officers?

Think of the chain of evidence custody. Any opposing legal / lawyer type will argue that it *could* have been tampered with. Onyl law enforcement officers , or those acting on their behalf, can swear to the condition of evidence and maintain the chain of evidence.

I'm not a legal type person so I could be wrong with the above. However, I have studied a bit and off the top of my head, those are the things that I can think of. You dont want to find the guy that stole your stuff and then end up havign to sell it all off to pay for the fine you get in the civil case brought against you by the person you eavesdropped upon to gather the necessary information.

Also, even if you only use the data to work out where the current owner lives. How is a police officer suppoed to explain how they knew where to look?

Thank you so much for taking the time to explain all that LOLth. You make a lot of sense. The detective that we are working with is aware that I have been looking at and logging these details and has asked me to just keep track of any information we have.

I will have to take all this into consideration when giving the police the information. I would be happy to give the police the logmein details and let them copy over files, but I fear the time involved would be too much for them as the laptop isnt always on and its a slow connection. there was a point where we took pictures from the mac's photobooth folder, they were pictures the people took and I did that in the prescence of the detective and printed the images for him.

as for the IP addresses I get those from logmein and I dont even have to connect to the computer for that.

I see your point that I could potentially be liable for invasion of privacy if the other person decided to fight this in the end. while i would have no intention of paying any fine or penalty if such a situation arose I also would like to do this all legally and above board in cooperation with the police.

as it is, I am not actually taking anything off the iphone directly but I am copying the backup files that it makes in the mobile sync folder which is on the hard drive of the laptop. It is also my current understanding that there is no dispute of ownership as we have serial numbers and receipts to prove that the laptop is ours, however I could be wrong about this.



So in light of what Lolth has said I'm going to have to decline dlofneps generous offer to help read through the cookies and history folders. I wouldnt want to get anyone into trouble if worst case scenario the police were unhappy with how we got the info. Thank you though dlofnep !

richiek

Also, I was just thinking....

hal emmerich posted this in the other place where I posted this thread

http://www.youtube.com/watch?v=U4oB28ksiIo&feature=player_embedded

in it the guy describes how he obtained info about the thief of his computer and passed it onto the police to get it back, that sounds to me like what LOLth was talking about.

maybe the laws in america are different but it seems in that case the police were fine with the guy hacking his own computer to find out who stole it.

LoLth

the privacy laws in Europe are much more strict, as well as the evidential requirements and the divide between civil and criminal legal professional standards. Also, American law is more advanced than European law when it comes to dealing with technological matters, possibly due to a higher volume of legal issues being brought to court.

If you have a detective beside you watching and okaying your actions you should be good. Just make sure you clear any intended actions with him/her before you take them.

richiek

Cool, thanks for clarifying. We've been co-operating as much as we possibly can and we've been very clear with what we have been doing with the detectives.

rolion

sorry for your problems but if i had bought a second hand laptop first thing i will do is insertd cd and format/reinstall OS.Also,if i have to leave it as it is AND i will find out that somebody (anyone) is logging remotely and searching through my files i will become a victim and look for the intruder ! even can go so far as tracing and bring it in justice !

The 'new' owner is not aware of the laptop being stolen and as far as she/he is concerned she/he has a laptop bought from somebody that easily can state that was his/her laptop !!! Can we prove the contrary... ?

If i will be in your place now,i will make sure that i keep a record for all the activity with the detective ,just to be covered at a later stage !! You never know how this things turns around...

Also,having the "new owner" phone number ... what more than that a police /detective needs to execute a search and/or a arrest !??? If that is not achievable due to some unknown reasons, then I will cut&paste or delete my personal data stored on the laptop and forget it !

good luck...

richiek

rolion wrote: »

sorry for your problems but if i had bought a second hand laptop first thing i will do is insertd cd and format/reinstall OS.

I totally agree, but this person doesn't appear to know how to do that; or even know that it might be neccessary.

rolion wrote: »

Also,if i have to leave it as it is AND i will find out that somebody (anyone) is logging remotely and searching through my files i will become a victim and look for the intruder ! even can go so far as tracing and bring it in justice !

The 'new' owner is not aware of the laptop being stolen and as far as she/he is concerned she/he has a laptop bought from somebody that easily can state that was his/her laptop !!! Can we prove the contrary... ?

I get this point too, but in fairness, the laptop was bought without a charger from a young teenage boy. (The detectives know the person who robbed the apartment because they were caught on a couple of ATM cameras using stolen cards.) It was sold the day after it was stolen in a market area of Berlin, no bag, no receipts, no original discs, no proof of purchase and there is still pictures of us and our info on the laptop.

so yes we can prove to a point that there would have been at least some suspicion of the laptop being stolen and the police are aware of this, the laptop serial number would also have been entered into a stolen goods database the day before by the police.

it could be a situation that someone bought the laptop for the guy as a present not saying where it was from, either way they bought stolen goods. They also still had to go out and get a new charger.

I too would be angry if i had bought a laptop and someone was digging through all my info on it, but as it stands the laptop is still our property, no doubt about it and I am more than entitled to connect to it remotely. The police have also been notified regularly of the information we have been taking.

rolion wrote: »

If i will be in your place now,i will make sure that i keep a record for all the activity with the detective ,just to be covered at a later stage !! You never know how this things turns around...

We have been keeping logs of the times the laptop has been used and also what we have been copying. Some of the photos have already been handed over to the police and some people have been identified as known to the police previously.

rolion wrote: »

Also,having the "new owner" phone number ... what more than that a police /detective needs to execute a search and/or a arrest !??? If that is not achievable due to some unknown reasons, then I will cut&paste or delete my personal data stored on the laptop and forget it !

good luck...

You could be right that a phone number/IMEI number would be enough for the police to obtain information and go arrest the person, however in Germany it is required by law to get a judgement by a judge and a lawyer to sign off on the evidence. If the judge decides that its not enough info we're back to square 1.

we have backed up all the info from the laptop and deleted sensetive files already however we will leave normal things like pictures and music there in the hope that it can help identify the laptop as ours.

We're also not in a position to just forget about the laptop, as it is we both earn very little money and cant afford to replace anything. At the moment I have a loaner laptop from work but my contract ends in August which leaves us without a computer again.

I appreciate your point of view and your words of caution, but I am willing to risk any sort of "hacking" charges (even though its hardly hacking) or reprecussions from the person who has the laptop as we have F*ck all left after the burglary.

One way or another I will do everything I can to get this laptop back.

rolion

Thanks for reply and i do understand your feelings...

I can promise you that,at your return in Dublin,i will provide you with a fully working desktop computer,if that helps your "IT Experience" in any ways...

Again,good luck...
Regards

richiek

rolion wrote: »

Thanks for reply and i do understand your feelings...

I can promise you that,at your return in Dublin,i will provide you with a fully working desktop computer,if that helps your "IT Experience" in any ways...

Again,good luck...
Regards

Cheers Rolion, thats incredibly generous of you! I actually wont be home any time soon though

I should be talking to the police again next monday. I'll let you know how I get on.

_CreeD_

You could log in and remotely send an email from their account to the Whitehouse claiming you want to commit an act of terrorism against the US...Just sayin'

(and no don't do this, it would get a reaction though)

richiek

ha ha that would be funny alright.

As for an update, no news so far, just a couple of new iPhone backups.

We should be able to talk to the police again tomorrow and make a plan.

obviousTroll

Hi richiek.

I havent read this thread so I thought I'd make a request that is a complete breach of privacy.

richiek

Hey obviousTroll,

Sorry I won't be making any of this guys personal details available, after all he's potentially a victim in this case too, he just happens to have our stuff. Yes he may have knowingly bought stolen goods but thats not the point.

Initially that would have been my intention with this thread, hoping that perhaps some kind folk here could help me sift through the data; but I was also given some cautious advice from other members on here that I am already potentially invading his privacy and leaving myself open to hacking charges if sh*t goes bad for whatever reason.

So in the interest of not wanting to get anyone here into trouble, and also out of a measure of respect for the person who has the laptop (he didn't steal it in the first place) I'll won't be sharing the data.

On the other hand if it so happened that it was the guy that originally broke in, then I would be handing the information out like candy; but I have been reassured by the detectives that he isn't.

for peoples interest I was using MesaSQLite to browse parts of the iPhone backups. I also used the iPhone tracker program, other than that I have used just the plain osx text editor to look at some files.
I also used preview in osx to get GPS exif data from the iPhone pictures.

obviousTroll

Nice move, and I totally understand your motives for keeping the data secure.

My advice is that if you have a basic location, and you're aching to find out, use a wireless sniffing program such as kismet or such, and scan to see if your laptop's MAC address shows up. It would at least prove the location of the device. Location of the iPhone may pop up also if the MAC is known (which with a bit of work should be easy to find).

A bit of social engineering may localize the address further. At the very least, it would lead to your property being recovered. Just my two cents on the matter.

Good luck with getting your stuff recovered.

richiek

obviousTroll wrote: »

Nice move, and I totally understand your motives for keeping the data secure.

My advice is that if you have a basic location, and you're aching to find out, use a wireless sniffing program such as kismet or such, and scan to see if your laptop's MAC address shows up. It would at least prove the location of the device. Location of the iPhone may pop up also if the MAC is known (which with a bit of work should be easy to find).

A bit of social engineering may localize the address further. At the very least, it would lead to your property being recovered. Just my two cents on the matter.

Good luck with getting your stuff recovered.

Cheers thanks

The idea about kismet is actually a really good idea, could be useful if we needed to double check that the laptop is where we think it is. I'll have to check that out.

obviousTroll

obviousTroll wrote: »

Hi richiek.

I havent read this thread so I thought I'd make a request that is a complete breach of privacy.

Thanks for the edit Lolth.

richiek

Ah yes, sorry I forgot to credit LOLth with the privacy advice, thanks again for taking the time to write that again LOLth, its actually been quite a lot of help with the police!

AstonMartin

Is it cheap to install a gps tracker into electronics if they ever need to be found?

richiek

No idea how much it would be, but I spent a couple of minutes googling for some sort of gps chip you could put in a laptop and i guess your best bet would be to get something like a minipci gps chip for your laptop, but I guess that could be problematic.

if you only have 1 pcie slot in your laptop it might be used already by your wireless card. I know my toshiba laptop used its only free pcie slot for the wireless card.

I have no idea how much the chips cost either, but there was this one on ebay...
http://cgi.ebay.com/Mini-GPS-u-blox-B39-PCI-5S-PCI-Express-Wireless-Card-/150509664012?pt=PCC_Video_TV_Cards&hash=item230b13370c

then again that could be the wrong size

Also I'm not sure how you would get the coordinates of the laptop if it was stolen, might need a software element like prey or maybe there's cards out there that just send their details to an email address, I really don't know

obviousTroll

AFAIK richiek, the GPS module you are talking about will

A: only work while plugged into the computer, and the computer is on

and B: only sends the GPS data to the laptop in question.

Assuming the thief didn't remove the GPS unit, and you catch a lucky break by having LogMeIn or similar installed, then you MIGHT have a chance of recovering the laptop, otherwise it's a waste.

EDIT:
Just saw your response on the bottom of your last post. Prey uses GPS on its phone software, so laptops should use it too.

richiek

obviousTroll wrote: »

AFAIK richiek, the GPS module you are talking about will

A: only work while plugged into the computer, and the computer is on

and B: only sends the GPS data to the laptop in question.

Assuming the thief didn't remove the GPS unit, and you catch a lucky break by having LogMeIn or similar installed, then you MIGHT have a chance of recovering the laptop, otherwise it's a waste.

AHA, thats what I was started to think halfway through writing my last post.
but perhaps something like this could be used in conjunction with prey or other anti theft software, maybe the software could attempt to get a gps position also while it is generating a report.

again though I guess this also depends on if the thief/person who buys the stolen goods doesn't just outright format the machine once they get it.

Dude111

I hate ppl who steal things....

I hope LOGMEIN will help you get it back...

See if you can get an IP address where the laptop is and then try to ID where that is..


Good luck buddy

richiek

Dude111 wrote: »

I hate ppl who steal things....

I hope LOGMEIN will help you get it back...

See if you can get an IP address where the laptop is and then try to ID where that is..


Good luck buddy

Thank you! its always nice to hear support from people.

Sorry to all those following the thread, so far there is no real update other than the detective has gone to a judge to get another search warrant, but due to the size of the file and extra information, it will take time to process the case.
In the meantime we have discovered that the guy who has the laptop has managed to reset the admin password and deleted all the accounts on it.

thankfully we have a time machine backup and logmein still seems to be functioning.

Will update again when I have more info.

Dude111

Its amazing LOGMEIN is still working!! (The idiot must be the average criminal: "STUPID")

I hope you can get it back....... Log on and goto www.whatismyip.org and you should get an IP.........

syklops

Maybe I asked this before, but is there anyway, you cluld get the MAC address of the wireless AP your laptop is connected to? If so, you can query googles DB of wireless APs, and could get GPS co-ordinates of its 'home'.

Let me know if you need more help or clarification.

syklops

Dude111 wrote: »

Its amazing LOGMEIN is still working!! (The idiot must be the average criminal: "STUPID")

I hope you can get it back....... Log on and goto www.whatismyip.org and you should get an IP.........

You'ed be amazed what goes on.

Check out:

https://www.youtube.com/watch?v=U4oB28ksiIo

golgi

just stumbled across this and Im extremely intrigued as to whats happened? Is the laptop returned to its rightful owner ?

Keith186

This reminds a little of the Bourne Supremacy!

Hope you got the laptop back Richie.

smokiebeverage

Might be worth a look, if you have a back up of an iphone. http://www.redcode.nl/blog/2011/04/reading-iphone-gps-data-from-backup-with-java/

As far as I know receiving stolen goods in germany is a serious offense as there are loads of laws on the subject post world war 2 to help the Jewish people get their goods back. Ask the officer he should be able to tell you.

richiek

Cheers smokie, must check that out, I was looking at the database with MESAphp to look at individual entries, will have a look at that.

Sorry to not update more regularly, but unfortunately there hasnt been an awful lot of news for us either.

As it stands we managed to get a signifigant amount of detail from the iPhone and both us and the detective managed to find out the home address of the guy with the laptop.

the detective put the case in to get a warrant the other week, but as this was less urgent it took more time to get one which was a problem as the detective is now on holidays as of today and we only got the warrant on wednesday; despite the detective calling dailey to see if it was ready.

SO, theres more waiting for us, but hopefully when the detective is back we can co-ordinate a time to go get the laptop.

Thanks again everyone for your interest and support!

richiek

and @ syklops, I never managed to get the mac address no, I think someone mentioned that before alright, but we have quite a bit of information including home address and typical times that he might be home too so I'm leaving it up to the police now

thanks for the suggestion though

richiek

Just to update everyone on this case, Sorry there has been pretty much no News lately but there just simply has been no news, things were going very slowly with getting a new warant to search the guy home.

But, today all our waiting and waiting has paid off!!! the Police have recovered the stolen laptop and its is now in their custody, ready to be picked up by us today!

From my girlfriend and myself I would like to thank all of you who showed an interest and support with this whole thing, its been a lot of help.

I would also like to especially thank the Berlin Police department who were relentless and extremely patient. they did an absolutely wonderful job and I cant thank them enough!!

for your interest also, the other thread that was open is located here
http://www.boards.ie/vbulletin/showthread.php?p=73621370&utm_source=notification&utm_medium=email&utm_campaign=notify#post73621370

Elmidena

It's absolutely amazing that you managed to source it the way you did, I'm majorly impressed!
Hopefully things will finally look up for you now OP

richiek

Cheers Sunshine! We're delighted ourselves.