FOUND pr0n @ WORK

[LeiZaK]

A PC was left logged on last night after one of my co-workers left for the day. For a period of about an hour, between 6:11 pm and 7:15 pm, someone got on this computer and was surfing porn.
Funny thing is, they also plugged in their Ipod which recorded the following in the event viewer:

Received a device interface REMOVAL notification for device:
\\?\USBSTOR#Disk&Ven_Apple&Prod_iPod&Rev_1.62#000A270014183C7D&0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}

What I want to know is... Is any of this information identifying, such as the bolded numbers being part of the serial number? Can someone check?

Thanks

 

[LeiZaK]

Edited title to get more views. Can someone help me out?

 

[edro]

000A270014183C7D is the owner's Social Security Number in Hex. Seriously.

 

[pontifex]

so, even if you find out if this really is the serial #, are you just going to go around and ask everyone that has an ipod to see their serial number?

 

[Juice Box]

THe Ipod Serial # is 12 Characters, alpha-numeric IIRC......and most people don't even register it, so I doubt apple can help you

 

[LeiZaK]

Originally posted by: pontifex
so, even if you find out if this really is the serial #, are you just going to go around and ask everyone that has an ipod to see their serial number?

No... the General Manager thinks he knows who it is. He is simply going to ask to see their iPod and look at the serial.

 

[AMDZen]

Originally posted by: pontifex
so, even if you find out if this really is the serial #, are you just going to go around and ask everyone that has an ipod to see their serial number?

LoL thats what I was wondering.

Just call forensics and have them dust the keyboard, thats the only way you'll catch the culprit

 

[dman]

They could probably search other workstations for that message in the event log to see who the owner is. However, if you have a cleaning crew, or facilities, probably was somebody there. Chalk it up as a lesson learned clean the pc and remind users this is why we lock our workstations, etc.

 

[venk]

\\?\USBSTOR#Disk&Ven_Apple&Prod_iPod&Rev_1.62#000A270014183C7D&0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}

It wasn't me, I swear!

 

[Wapp]

I suggest you use a properly configured proxy server in the future.

 

[Juice Box]

Why not have someone you know try to connect and disconnect their ipod, of which you KNOW the serial number...and try to find some sort of coorelation?

 

[Safeway]

Is it 12 or 16 characters?

 

[MikeyIs4Dcats]

Originally posted by: dman
They could probably search other workstations for that message in the event log to see who the owner is. However, if you have a cleaning crew, or facilities, probably was somebody there. Chalk it up as a lesson learned clean the pc and remind users this is why we lock our workstations, etc.

good idea. if he used it at that station, he probably uses it at his station too.

 

[LeiZaK]

Originally posted by: Juice Box
Why not have someone you know try to connect and disconnect their ipod, of which you KNOW the serial number...and try to find some sort of coorelation?

That's kind of why I posted here. There's a lot of people here that have iPods, no?

 

[LeiZaK]

Originally posted by: MikeyIs4Dcats

Originally posted by: dman
They could probably search other workstations for that message in the event log to see who the owner is. However, if you have a cleaning crew, or facilities, probably was somebody there. Chalk it up as a lesson learned clean the pc and remind users this is why we lock our workstations, etc.

good idea. if he used it at that station, he probably uses it at his station too.

99.9 % sure the person has no computer or log-in for the domain.

 

[MisterJackson]

Originally posted by: AMDZen

Originally posted by: pontifex
so, even if you find out if this really is the serial #, are you just going to go around and ask everyone that has an ipod to see their serial number?

LoL thats what I was wondering.

Just call forensics and have them dust the keyboard, thats the only way you'll catch the culprit

He's be better off using a black light on that keyboard to illuminate the spooge.

 

[Thegonagle]

Dear Witch Hunter,

I've got an iPod right here (my cousin's), but I'm not going to help you fire someone for doing something that didn't hurt anyone.

Neener.

It's probably better to warn the person who left the station logged in.

 

[TraumaRN]

Originally posted by: LeiZaK

Originally posted by: MikeyIs4Dcats

Originally posted by: dman
They could probably search other workstations for that message in the event log to see who the owner is. However, if you have a cleaning crew, or facilities, probably was somebody there. Chalk it up as a lesson learned clean the pc and remind users this is why we lock our workstations, etc.

good idea. if he used it at that station, he probably uses it at his station too.

99.9 % sure the person has no computer or log-in for the domain.

This is why God created a suspend session(which at my work logs you off while saving your work so when you log on again it brings your saved work back up immediately) or log off key....

 

[LeiZaK]

Originally posted by: Thegonagle
Dear Witch Hunter,

I've got an iPod right here (my cousin's), but I'm not going to help you fire someone for doing something that didn't hurt anyone.

Neener.

It's probably better to warn the person who left the station logged in.

The normal user of the computer is disgusted and doesn't want to sit in her chair. This was also done on company timeand property. The user has been warned and re-warned to log off of the system when she leaves.

 

[MikeyIs4Dcats]

Originally posted by: DeathBUA

Originally posted by: LeiZaK

Originally posted by: MikeyIs4Dcats

Originally posted by: dman
They could probably search other workstations for that message in the event log to see who the owner is. However, if you have a cleaning crew, or facilities, probably was somebody there. Chalk it up as a lesson learned clean the pc and remind users this is why we lock our workstations, etc.

good idea. if he used it at that station, he probably uses it at his station too.

99.9 % sure the person has no computer or log-in for the domain.

This is why God created a suspend session(which at my work logs you off while saving your work so when you log on again it brings your saved work back up immediately) or log off key....

and why Microsoft makes a password-protected screensaver

 

[MikeyIs4Dcats]

Originally posted by: Thegonagle
Dear Witch Hunter,

I've got an iPod right here (my cousin's), but I'm not going to help you fire someone for doing something that didn't hurt anyone.

Neener.

It's probably better to warn the person who left the station logged in.

you're an idiot. thanks for posting.

 

[Thegonagle]

Originally posted by: MikeyIs4Dcats

Originally posted by: Thegonagle
Dear Witch Hunter,

I've got an iPod right here (my cousin's), but I'm not going to help you fire someone for doing something that didn't hurt anyone.

Neener.

It's probably better to warn the person who left the station logged in.

you're an idiot. thanks for posting.

Thanks for your opinion.

Say, I think I hear an angry mob outside that you can join.

 

[TraumaRN]

Originally posted by: MikeyIs4Dcats

Originally posted by: DeathBUA

Originally posted by: LeiZaK

Originally posted by: MikeyIs4Dcats

Originally posted by: dman
They could probably search other workstations for that message in the event log to see who the owner is. However, if you have a cleaning crew, or facilities, probably was somebody there. Chalk it up as a lesson learned clean the pc and remind users this is why we lock our workstations, etc.

good idea. if he used it at that station, he probably uses it at his station too.

99.9 % sure the person has no computer or log-in for the domain.

This is why God created a suspend session(which at my work logs you off while saving your work so when you log on again it brings your saved work back up immediately) or log off key....

and why Microsoft makes a password-protected screensaver

We use Citrix virtual desktop...which usually eliminates the need for screensaver password...plus the default desktop only allows you to access the hospital intranet....so unless you have a log on name to Citrix you're screwed...no pun intended...

 

[LeiZaK]

I'm thinking the serial number might be 270014183C7D (the bolded number minus the "000A" at the beginning). It's the only combination I can type into Apple Support have it appear valid.

 

[OutHouse]

Originally posted by: Thegonagle
Dear Witch Hunter,

I've got an iPod right here (my cousin's), but I'm not going to help you fire someone for doing something that didn't hurt anyone.

Neener.

It's probably better to warn the person who left the station logged in.

I agreee.