Intrusion Detection

[wade moore]

Ok.. so.. I'm actually quite computer savvy, in fact I've been working Help Desk for over 5 years, etc, etc...

But, I do not know how to deal with a situation that has come up. My Girlfriend and I have a heavy suspicion that our roommate is going into her computer and reading her e-mail. I'm not sure how to tell. She uses Windows XP, so there is not lock computer option, or I would just do that.. does anyone know of any software or anything that can be installed to determine if her computer is being accessed when neither her or I are there?

[sabotai]

wade, Just go to Control Panel and then to User Accounts. She should have at least one account (the administrator account, or something like that.) Click on that account and then password that account. Problem solved.

[Fritz]

Wade, if you are using XP or 2000 you can set it up to put a login or file access into the event log.

[wade moore]

But part of the point is that I don't want ot have to make her log in and log out constantly to user her computer... she goes back and forth from classes, etc..

If I have to I will, but I was trying to avoid that..

[Fritz]

wade,

just audit access to the file where the mail is stored.

[sabotai]

What program does she use for her e-mail? Can't you password that so the roomate can't get into the e-mail account?

Better yet, why don't you find some software that runs in the background and records activity. Then you could find out if the roomate is actually logging on and checking the e-mail

[wade moore]

The background software is what I was asking about ;)..

She uses Outlook Express... even if it asks for password, you cancel and see the mail that has already sent because it's pop'ing it local..

[RoastDuck]

If you want to pay for it, full system surveilence is quite cheap. I detected someone using my unit after office hours using 007 Golden Eye:

http://www.imagespro.com/programs/1570/

[wade moore]

So does this basically take a video log of what happens on your computer? That would be great! I see that it's shareware, is there a temporary license to try it out?

[RoastDuck]

This is going back a bit but the version I had was a text log - nothing fancy. The good thing was it recorded every single keystroke with times and dates - the evidence was Colin-esque in its irrefutable-ness.

As I recall the shareware version splashes a huge WECOME! sign upon Windows start-up. Basically the shareware proves to the potential client that the software does what it says but you cannot use it covertly.

A lot of this stuff exists and you may be able to find a free version of a similar program elsewhere but I can recommend 007 from my own experience.

[wade moore]

Thing I'm worried about it she could go into the e-mail, read it, and never have a "key stroke", only mouse clicks..

[Fritz]

you could put poison on the keyboard or mouse.

you may want to get your GF some latex gloves.

[JonInMiddleGA]

Originally posted by wade moore
The background software is what I was asking about ;)..

She uses Outlook Express... even if it asks for password, you cancel and see the mail that has already sent because it's pop'ing it local..

This might also do what your looking for

" iReport 2003 can discreetly take snapshots of whatever is on the computer screen, record any detected system activity (chat conversations, instant messages, e-mails typed and read, all web sites visited, all programs/applications run), log all keystroke activity, and much more. "
http://download.com.com/3000-2094-10181899.html?tag=lst-0-18

[wade moore]

I'll check that out when I get home, thanks Jon!

[sabotai]

EDIT: Nevermind, it was a free LITE version that does dick....

[Marmel]

or you can try yelling at her: "Stay the fuck off my girlfriends computer, or I will force you to look at pictures of Fritz, naked, you bitch!"

That should do the trick.

[Daimyo]

I've never bothered with XP Home, can it support NTFS? If so you can convert your disk to NTFS and enable auditing. With that you would easily have the power to tell pretty much anything you want... you could audit the email file to see when its accessed, you could audit the email application itself to know everytime the process was started, etc, etc. Very powerful stuff.

[Daimyo]

Dola, NT auditing has the added benefit that you don't need to buy or install any extra software... it records it right to the event log.

[wade moore]

Originally posted by Marmel
or you can try yelling at her: "Stay the fuck off my girlfriends computer, or I will force you to look at pictures of Fritz, naked, you bitch!"

That should do the trick.

Well, see... Fritz might like that too much... he can feel that through the computer you know..


I've decided to take the high road and just change the settings (didn't realize there was a setting to change) so that she can lock the computer...

As much as I wanted to know for sure to bust the chick, it's just not worth it.. she's moving out in a few months anyways...

Thanks for all of the suggestions guys!

[Alf]

XP does indeed support NTFS. I installed my "new" computer with NTFS because I make some home made videos of my daughter (grandparents love this stuff), so definitely yes, NTFS can be installed on XP (and I would recommend it).

AS for the auditing part with NTFS, I have no idea of how it works.

[SnowMan]

Can't you just add a password to her screen saver?

[Fritz]

From the Help Files

Auditing file and folder access
You can audit file and folder access on NTFS volumes to identify who took various types of actions with the files and folders.

When you audit a file or folder, an entry is written to the Event Viewer security log whenever the file or folder is accessed in a certain way. You specify which files and folders to audit, whose actions to audit, and what types of actions are audited.

To set auditing on a file or folder, use Group Policy to enable auditing, and then use Windows Explorer to specify which files to audit and which type of file access events to audit.

You can audit successful and failed attempts of the following types of directory and file access:

[tells you]