ATOT - Detectives

[Drekce]

My wife is a high school chemistry teacher. She came into her classroom this afternoon and saw that the directory where she keeps all of her tests was open on the Windows desktop. Is there a way to find out (in Windows XP) if anything was printed or copied over to a memory stick? I am going to check the browser history to see if any webmail accounts were used to send the tests.

Thanks for any help you can provide.

 

[illusion88]

You could hsee when the file was last accessed, assuming she didn't open it since then. That will at least give you a times table to work with.

 

[pontifex]

eventviewer maybe? i'm sure that will tell if anything has been printed, i would assume it would tell if a memory stick was attached also


just tested both and it didn't show any changes to event viewer...guess i was wrong

 

[Legendary]

I don't think Event Viewer would keep track of that without being specifically told to.
Your wife should change her tests.

 

[Drekce]

Yeah, neither of those ideas work.

 

[QED]

Originally posted by: Legendary
Your wife should very subtly change her tests.

Fixed.

The bastages that stole the tests won't notice the slight change in the wording and will correctly answer all of the wrong questions.

 

[QED]

Originally posted by: Drekce
Yeah, neither of those ideas work.

Really? Usually event viewer should at least tell you when/if something was printed.

For the other things, you are probably out of luck.

 

[AdamSnow]

No way to tell if it was copied to a drive or anything... Checking the history for webmail accounts won't give you an accurate time frame, so you can't go accusing anyone of doing anything.

I think your wife needs to learn how to lock her workstation... She needs to assume that every test was copied, and change them accordingly.

 

[BooGiMaN]

just tell her to be patient..most highschool kids that would reosrt to this are idiots and blabbermouths..

they wont resist bragging...and that will be their downfall..

 

[K1052]

Originally posted by: MathMan

Originally posted by: Legendary
Your wife should very subtly change her tests.

Fixed.

The bastages that stole the tests won't notice the slight change in the wording and will correctly answer all of the wrong questions.

Yes, have her do this.

 

[Pepsei]

printed? go to event viewer, system tab, you'll see "print" event and time.

just did it on windows 2003 server.

 

[Bootprint]

Originally posted by: pontifex
eventviewer maybe? i'm sure that will tell if anything has been printed, i would assume it would tell if a memory stick was attached also


just tested both and it didn't show any changes to event viewer...guess i was wrong

I get a "Received a device interface ARRIVAL notification for device:" in the event log when I plug in a usb stick.

 

[Soccer55]

Originally posted by: MathMan

Originally posted by: Legendary
Your wife should very subtly change her tests.

Fixed.

The bastages that stole the tests won't notice the slight change in the wording and will correctly answer all of the wrong questions.

This will almost definitely work. Either a slight change in wording or a slight change in the measurements/chemical formulas in each problem should be enough to identify the cheaters. In my limited teaching experience, I've noticed that students tend to be creative, but really bad at cheating and in a case like this, they're almost certain to just write down the answers without reading the problem carefully enough to notice that it has changed.

-Tom

 

[Drekce]

Her classroom was locked; that is why she didn't lock her WS. She thinks a student told another teacher that they left something in the room to get it unlocked. She is going to ask around to see if another teacher did this.

 

[JSFLY]

Originally posted by: Drekce
Her classroom was locked; that is why she didn't lock her WS. She thinks a student told another teacher that they left something in the room to get it unlocked. She is going to ask around to see if another teacher did this.

Good stuff! Keep us up to date on the case!

 

[gwrober]

Originally posted by: AdamSnow
She needs to assume that every test was copied, and change them accordingly.

QFT. That's how we do it in the gvmt world.....

Or maybe she should get a Microsoft WSYP (we share your pain) chair.....

WSYP

 

[Soccer55]

Originally posted by: Drekce
Her classroom was locked; that is why she didn't lock her WS. She thinks a student told another teacher that they left something in the room to get it unlocked. She is going to ask around to see if another teacher did this.

If this is the case, I am amazed that the other teacher would let the kid be unsupervised in your wife's classroom. I would have expected the other teacher to keep an eye on the kid while the room was unlocked. I say unsupervised because I can't see why any teacher would knowingly give a student access to another teacher's workstation.

-Tom

 

[zanieladie]

Man...that is terrible. So much for honesty and integrity. *Sigh*

 

[pontifex]

Originally posted by: Bootprint

Originally posted by: pontifex
eventviewer maybe? i'm sure that will tell if anything has been printed, i would assume it would tell if a memory stick was attached also


just tested both and it didn't show any changes to event viewer...guess i was wrong

I get a "Received a device interface ARRIVAL notification for device:" in the event log when I plug in a usb stick.

doesn't show up on my xp system...unless its taking forever for it to write to the log or something

 

[pontifex]

Originally posted by: Soccer55

Originally posted by: Drekce
Her classroom was locked; that is why she didn't lock her WS. She thinks a student told another teacher that they left something in the room to get it unlocked. She is going to ask around to see if another teacher did this.

If this is the case, I am amazed that the other teacher would let the kid be unsupervised in your wife's classroom. I would have expected the other teacher to keep an eye on the kid while the room was unlocked. I say unsupervised because I can't see why any teacher would knowingly give a student access to another teacher's workstation.

-Tom

door was locked, not workstation

 

[Drekce]

She just got done changing the test. It is very "numbers" based, so easily changed. She is hopeing to catch the perp by looking for the old answers.

 

[alien42]

ohhhhhh

this is like the bloodhound gang

 

[Soccer55]

Originally posted by: pontifex

Originally posted by: Soccer55

Originally posted by: Drekce
Her classroom was locked; that is why she didn't lock her WS. She thinks a student told another teacher that they left something in the room to get it unlocked. She is going to ask around to see if another teacher did this.

If this is the case, I am amazed that the other teacher would let the kid be unsupervised in your wife's classroom. I would have expected the other teacher to keep an eye on the kid while the room was unlocked. I say unsupervised because I can't see why any teacher would knowingly give a student access to another teacher's workstation.

-Tom

door was locked, not workstation

Right, but I'm saying that I'm amazed that another teacher unlocked the door for the student and didn't keep an eye on him/her while the student was in someone else's classroom. So if unsupervised, the student would have access to the workstation. Now, whether or not they would be able to do anything with the workstation is a different story, but the fact that they'd have the chance to mess around with it is what I was getting at.

I probably should have used a word other than "access"

-Tom

 

[arcenite]

Originally posted by: Drekce
She just got done changing the test. It is very "numbers" based, so easily changed. She is hopeing to catch the perp by looking for the old answers.

keep us updated!!!!!!

 

[MotionMan]

Now that your wife has been bitten, she should know to lock her workstation whenever she is going to leave the room. She should also (or at least) put a password on the screensaver (with a 5 minute delay).

MotionMan