-
JerichoJones replied to the topic Need to determine the computer a user account is coming from in the forum Forensics 10 years, 10 months ago
These are students so WebCams are not an option.
I think I may have to look at sniffing. Bummer. I don’t know squat about that.
-
JerichoJones replied to the topic Need to determine the computer a user account is coming from in the forum Forensics 10 years, 10 months ago
Yes I am talking about a user account shared among several people.
The crux of the issue is:
Nothing in the event log ties a user to a computer. If I have the Same ID logging on at the same time there is no way (that I see) to tie them together conclusively.
The computer and user both authenticate but these are seperate entries in the event log…[Read more]
-
JerichoJones replied to the topic Need to determine the computer a user account is coming from in the forum Forensics 10 years, 10 months ago
All this would be fine but I am talking about a shared account.
-
JerichoJones replied to the topic Need to determine the computer a user account is coming from in the forum Forensics 10 years, 10 months ago
Thanks for the link. It was informative.
If I read this correctly I am still at square #1. 🙁
Fron the Article:
[Read more]
To recap just for a moment, when Fred logs on at his workstation for the
first time that day, the domain controller that handles that logon will log
event ID 672, closely followed by an event ID 673 where the Service
Name…