what happened to files?

[Guest]

so here's the scenario ... [xp sp2 pro on a windows 2k3 network]:

an employee left my company and i'm trying to see what might have become of
files that were on his desktop.

in the "recent" folder within "documents/settings" i can see shortcuts that
were modified on the date he left, near the time he left. the properties of
the shortcuts show that they were in a folder that was on his desktop.
neither the files nor the folder are on his desktop any longer and his
recylce bin is empy. using a recovery program i was able to recover deleted
files off his workstation, none of which were the files referenced in the
shortcuts.

could that indicate that those files were moved to another location like
removable media? are there tools i might use to determine what happened to
those files?

thanks for your help.

 

[Malke]

so here's the scenario ... [xp sp2 pro on a windows 2k3 network]:

an employee left my company and i'm trying to see what might have become of
files that were on his desktop.

in the "recent" folder within "documents/settings" i can see shortcuts that
were modified on the date he left, near the time he left. the properties of
the shortcuts show that they were in a folder that was on his desktop.
neither the files nor the folder are on his desktop any longer and his
recylce bin is empy. using a recovery program i was able to recover deleted
files off his workstation, none of which were the files referenced in the
shortcuts.

could that indicate that those files were moved to another location like
removable media?

Yes.

are there tools i might use to determine what happened to

those files?

No. You might have had some luck with auditing but you would have needed
to set that up before.

If your company is a large one and you are concerned about legal issues,
then do nothing further on that machine and consult a professional
computer forensics company. This will not be some local computer guy who
just says he does computer forensics and it will be very expensive.


Malke

 

[Guest]

so here's the scenario ... [xp sp2 pro on a windows 2k3 network]:

an employee left my company and i'm trying to see what might have become of
files that were on his desktop.

in the "recent" folder within "documents/settings" i can see shortcuts that
were modified on the date he left, near the time he left. the properties of
the shortcuts show that they were in a folder that was on his desktop.
neither the files nor the folder are on his desktop any longer and his
recylce bin is empy. using a recovery program i was able to recover deleted
files off his workstation, none of which were the files referenced in the
shortcuts.

could that indicate that those files were moved to another location like
removable media?

Yes.

are there tools i might use to determine what happened to

those files?

No. You might have had some luck with auditing but you would have needed
to set that up before.

If your company is a large one and you are concerned about legal issues,
then do nothing further on that machine and consult a professional
computer forensics company. This will not be some local computer guy who
just says he does computer forensics and it will be very expensive.

i suspected that would be the case. thanks for your thoughts, malke.

ross

 

[HEMI-Powered]

Today, =?Utf-8?B?cmFzZXJvbg==?= made these interesting comments
....

so here's the scenario ... [xp sp2 pro on a windows 2k3
network]:

an employee left my company and i'm trying to see what might
have become of files that were on his desktop.

in the "recent" folder within "documents/settings" i can see
shortcuts that were modified on the date he left, near the
time he left. the properties of the shortcuts show that they
were in a folder that was on his desktop. neither the files
nor the folder are on his desktop any longer and his recylce
bin is empy. using a recovery program i was able to recover
deleted files off his workstation, none of which were the
files referenced in the shortcuts.

could that indicate that those files were moved to another
location like removable media? are there tools i might use to
determine what happened to those files?

thanks for your help.

I assume you're either his boss or the system admin. So, why did
you let this dude leave before you ensured that he'd neither
deleted anything of value nor stolen anything of value, e.g.,
confidential company information? You're trying to close the barn
door now that the horse has left.

If this guy is a novice, and simply deleted the files, you can
probably recovered them with an undelete utility. If he were
clever, he overwrote all the HD blocks. Now, if your systems
people back up incrementally every night from the desktops and
the entire system each week, then reload from that.

But, if this dude came in with some high capacity discs of
somesort or a flash card, small external HD or something and
stole you blind, contact your personnel and security people. That
sort of thing is undoubtedly against your companies personnel
policies and is also a felony.

Now, make damn sure that you put protections in place for the
next person who leaves. Remember that the cleverer of them don't
tell you they're leaving, they quietly steal whatever it is they
want in digital or paper form, then one day they don't show up
for work, often leaving their PC in a mess e.g., with a login PW
that won't let you in.

 

[HEMI-Powered]

Today, =?Utf-8?B?cmFzZXJvbg==?= made these interesting comments
....

so here's the scenario ... [xp sp2 pro on a windows 2k3
network]:

an employee left my company and i'm trying to see what
might have become of files that were on his desktop.

in the "recent" folder within "documents/settings" i can
see shortcuts that were modified on the date he left, near
the time he left. the properties of the shortcuts show
that they were in a folder that was on his desktop.
neither the files nor the folder are on his desktop any
longer and his recylce bin is empy. using a recovery
program i was able to recover deleted files off his
workstation, none of which were the files referenced in the
shortcuts.

could that indicate that those files were moved to another
location like removable media?

Yes.

are there tools i might use to determine what happened to

those files?

No. You might have had some luck with auditing but you would
have needed to set that up before.

If your company is a large one and you are concerned about
legal issues, then do nothing further on that machine and
consult a professional computer forensics company. This will
not be some local computer guy who just says he does
computer forensics and it will be very expensive.

i suspected that would be the case. thanks for your thoughts,
malke.

ross

get cracking with law enforcement and arrest this guy! in case he
didn't know it, EVERYTHING he does while at work on your
equipment belongs to the company, including E-mails, etc. State
and federal law makes it quite clear that there is NO presumption
of privacy, you may monitor your employees or put any safeguards
you need in place to prevent theft. But, if theft does take
place, he is toast. And, assuming he stole this stuff to sell,
you may also get lucky when the police impound all his system
stuff in his home or office and your purloined information is on
it.

 

[Guest]

thanks, jerry.

it looks like this particular incident may not be as bad as it could have
been. however, the holes still exist and i must close them up as best i can.

once bitten ...

and i must say, i particularly appreciate your enthusiasm for getting this
guy!

again, thanks for your thoughts.

ross

 

[HEMI-Powered]

Today, =?Utf-8?B?cmFzZXJvbg==?= made these interesting comments
....

thanks, jerry.

it looks like this particular incident may not be as bad as it
could have been. however, the holes still exist and i must
close them up as best i can.

once bitten ...

and i must say, i particularly appreciate your enthusiasm for
getting this guy!

again, thanks for your thoughts.

Ross, I was Engineering Information Security Manager at the
Chrysler Group the last 5 1/2 years of my career (I retired in
2002). I worked closely with both personnel and building security
as well as the IT folks on exactly this type of thing many times.
We practised multiple scenarios for about 3 weeks almost full
time in January, 2001 to properly prepare for the blood bath
large-scale layoffs planned for mid-February.

If I made any contribution to the loss of data being too small to
measure, it was in convincing management and techies that the
time to prevent data loss is well BEFORE it becomes apparent who
is "on the bubble", meaning likely to be laid off. People have a
knack for know that sort of thing and if they intend to either
steal something or plant digital time bombs, they will do it
quietly well before they are laid off.

As for being enthusiastic about nailing this guy, I guess that is
because I witnessed a couple of examples of people who'd kited
information worth hundreds of thousands of dollars out of the
company on the sly over several months, and another guy who had a
unique way to embezzle money - he was signing bills from a
training company for training that was never delivered. Of
course, he was in cahoots with the training company and got a
percentage of what he got out. His employment was terminated and
he was prosecuted successfully both for grand larceny, a very
serious felony, and for multiple civil offenses dealing with
stealing information and using his position in management to
conspire to commit a crime.

You'd be suprised how fast just one guy getting hauled out in
hand cuffs gets around the grape vine!

To the techie stuff for just a moment, at the time, our PCs only
had floppy drives on them, no optical. But, while I wasn't
personally involved, I do know of a couple of cases where
employee or contract workers who had been planted specifically to
steal confidential information were bringing in portable high-
capacity storage devices and even a 2nd internal HD, dumping
everything from either a local PC, a CAD workstation, or
community share drives on the then-used Novell NOS. He took
advantage of the quirk in company security that they almost never
searched a person's clothing, they only checked brief cases,
lunch bags and the like as people were leaving. Security needed a
reasonable probably cause to detain someone and still did not pat
them down for the small devices with the stolen data on them,
they simply called the local police who read the guys their
Miranda rights and arrested them.

Where I was less successful was in convincing my management from
local first level supervision all the way to the V.P. of
Engineering that these risks are real and to put their own
policies in place to better safeguard our most critical
confidential information, that of new car models years prior to
introduction. My problem was that these car managers didn't
really believe the threat was real and were more focused on their
job in getting the cars built. Fortunately, except for the few
really graphic cases I described here, we never had any wholesale
thefts of confidential information - that we knew of.

And, therein lies the tail - THAT WE KNEW OF. We know that spy
photos weren't getting out and we were confident that our designs
most likely hadn't been compromised, but there are just so many
things that bring a high price that we really don't know. I'll
leave you with one more example not my company. Another large car
maker had some 65,000+ employee personnel files of everything
including their SSAN stolen when the laptop computer of a
personnel guy was stolen. The dumb-asses in personnel and the IT
folks had never even conceived of this happening, even though it
is very common, so no encryption or other safeguards at all were
in place.

In any event, I hope that you are able to recover from this
incident without serious damage to your business, and I hope that
you are able to use this one problem as a way of convincing YOUR
management to put policies and procedures in place that recognize
the threat and you help them develop ways of detecting when it
may be starting before another employee makes of with who knows
what.

Good luck!

 

[Guest]

again, jerry, thanks for your thoughts.

it sounds to me like you've had a lot of experience. and i'll agree with
you about management - their focus usually lies elsewhere and it can
sometimes be difficult to convince them that a threat is real.

i believe that our little scare will help in implementing stronger security.

hope you're enjoying your retirement.

ross

 

[HEMI-Powered]

Today, =?Utf-8?B?cmFzZXJvbg==?= made these interesting comments
....

again, jerry, thanks for your thoughts.

it sounds to me like you've had a lot of experience. and i'll
agree with you about management - their focus usually lies
elsewhere and it can sometimes be difficult to convince them
that a threat is real.

i believe that our little scare will help in implementing
stronger security.

hope you're enjoying your retirement.

You're most welcom, Ross. And, thanks for the vote of confidence!
Trouble is, the world of IT security has turned inside out even
since I retired in January, 2002. Yes, that was after 9/11 but
before the major changes in our government to fight the War on
Terror. That said, the bad guys are quite different today.

Yes, I am most enjoying my retirement even though I found my work
experiences fascinating albeit frustrating.I once sent an E-mail
describing in some detail exactly how somebody could come in
either as an employee or through the visitor's lobby, steal
whatever they wanted, and escape undetected to every executive in
Engineering, some 600 men and women. I got exactly one reply,
from my own V.P. His laconis response was "scary, isn't it,
Jerry?". Yes. So, I called his office and tried to get an
appointment with him to lay out a plan to remedy the situation,
being I couldn't do it alone. You guessed it! He was too busy
with cars to worry about me.

Let me lay some more on you: when I was appointed to my job in
August, 1996, I was reasonably prepared technically having led a
committee investigating information security for a couple of
years prior, and having an IT background as a programmer and
later CAD and PC support manager. I also had the "privelige" of
writing the job description for the new Info Security Manager
little knowing I was writing my own! I did a deep dive to learn
as much as I could as quickly as I could to augment what I
already knew about CAD/CAE/CAM and PC security, began working
with our two IT groups at the time, and working with our
intellectual property attorneys to create legally enforceable
policies and procedures. Supplier security was also a big issue,
and much tougher to get my arms around.

Fairly early, I came across an interesting statistic or two. One
was that of ALL confidential information lost by American
companies, something like 80% were inside jobs! Then, I ran
across a story about a multi-year study the USAF did on attempted
compromises of their various IT systems. They concluded that they
were detecting some 250,000 hits per month! Worse - for them and
our country - was that they estimated this number to be only
about 10% of the real total, the rest going undetected. And,
since it is impossible to prove a null hypothesis by example, the
Air Force guys had no clue what was purloined or damaged. By the
time I left active employment, I was reading that the number of
inside jobs responsible for confidential information theft had
grown to more than 90% and today, it is reaching nearly 100%. How
can that possibly be? Large companies, especially those dealing
with financial customers, medical privacy issues, and the like
hardened their systems enough that they believed that little was
getting through from the dirty side. But, more insidious was that
those who study this phenomenon have anecdotal data to support a
theory that more and more people are getting themselves hired
specifically to steal information! It is a scary world out there.

One last thought wrt information security: there's a saying in
the biz that says that the only two people that've never been
compromized or lost data are the arrogant and the ignorant. I'm
sorry you had to learn the hard way, but at least you're on top
of it now. This is the source of management's reluctance to take
this seriously. They THINK they are well enough protected and
since they'd never lost anything (that they knew of!), they saw
little need to take decisive action. So, they were both arrogant
and ignorant, and I was frustrated.

I'll give you one more example that happened at my company
several years ago after I'd left: an E-mail came in with the
malware netsky, I think, that locks onto the address book of the
recipient and sends their malware to everyone in it, does the
same to those recipients, etc. This was a classic denial of
service attack, not one aimed at stealing anything. But, the
nature of mathematical progressions caused the number of E-mails
ringing their way across the entire company world-wide quickly
went into the millions and yes, the system fell over. It needed
to be completely taken down and restarted. Just the log files on
the network that were studied to find how the malware had gotten
past the proxy servers protecting the internal network was on the
order of 30 GB!

Good luck in the future and ask any clarifying questions you
need. I am woefully out-of-date but will try to help, and others
will certainly try as well.

 

[Harry Johnston]

Fairly early, I came across an interesting statistic or two. One
was that of ALL confidential information lost by American
companies, something like 80% were inside jobs!

Not surprising. The important statistic, however, is how *often* is
confidential information lost, as this is a major factor in how much it is worth
to spend on preventing it. (As well as direct costs, you need to consider the
costs involved with loss of morale, increased staff turnover, and loss of the
best staff if you will insist on treating all employees as criminals.)

Harry.

 

[HEMI-Powered]

Today, Harry Johnston made these interesting comments ...

Not surprising. The important statistic, however, is how
*often* is confidential information lost, as this is a major
factor in how much it is worth to spend on preventing it. (As
well as direct costs, you need to consider the costs involved
with loss of morale, increased staff turnover, and loss of the
best staff if you will insist on treating all employees as
criminals.)

When dealing with the loss of confidential information, one must
distinguish between that which is protected by patent, copyright,
or trademark law and that which has no statutory protection, for
example, trade secrets.

The value of lost confidential information can be trivial, e.g.,
an E-mail you send to a friend asking them to join you for lunch
shows up on a blog. Or, the lost confidential information can
cause such enormous damage that the viability of an entire large
corporation can be at risk, e.g., knowledge of a future product
or service is obtained by compeitors or counterfieters who are
able to bring the product to market and deprive the owner of the
IP their rightful profits. And, lost confidential information can
subject the company losing the information to a variety of civil
and criminal penalties, e.g., revealing private medical
information about patients or revealing protected personal and
personnel information kept by companies for their employees.

You are correct that the amount of time, effort, energy, and yes,
money must be balanced against the real or perceived loss to the
company's sales, revenues, and profits, its reputation, or its
legal standing.

What is generally not adequately understood by managements is the
multiplicity of confidential information categories and relative
volumes in each category, nor do they fully understand the
possible negative ramifications if the confidential information
is disclosed in an untimely manner, whether it directly violates
any local, state, or federal laws or not.

Yes, loss of morale and employee turnover are issues, but they
pale in comparison to the very survival of the company. But,
protecting itself against loss of confidential information hardly
needs to be done in ways that make employees or contract workers
believe they are being treated as criminals. OTOH, it is of
upmost importance that employees and contract workers be aware of
their own legal rights and responsibilities and possible
consequences some of which may be severe if they are found to
have violated company policies or the law.

Beyond the general statistics and general notions of loss of
confidentiality I presented earlier, it is quite difficult to
make even mildly generalized statements as to how often the
information is lost, the amount which is lost, its importance to
the company, and its value. This is because absent laws that
require disclosure of the loss of confidential information,
companies conducting internal audits and investigations with or
without local, state, or federal law enforcement officers,
district or U.S. attorney's and the like by their very nature do
not reveal even the existance of an investigation until it is
concluded, much less the details of the investigation itself. In
my experience, results of investigatioons are never revealed
unless civil or criminal proceedings are brought against those
who caused the leak either explicitly or implicitly, or even if
employees or contract workers are found to have caused the
leak/loss of confidential information through incompetence or
other types of malfeasance.

The bottom line, though, is that each company from a sole owned
proprietaryship to the largest multi-national corporation must
establish clean and unambiguous definitions of what is and what
is not considereed confidential at all, what laws or regulations
are involved, and what policy or technical systems need to be put
in place to safeguard the information.

This has grown way out of proportion from the OP's original
question, largely because I began to give some examples from my
professional career to illustrate why it is likely not at all
required to have a companies entire policies available at the
time an employee or contract worker logs onto a computer system.