Have a very interesting case at the moment where our draft report includes the use of the unique ID created by Teamviewer to show via the team viewer logs (and carved fragments of the logs) that computers connected (or attempted to connect) to each other.
A defence, if stretched could question how unique this ID is and could it be possible that another PC with the same ID logged in. How would one independenly verify that the ID is unique? Or would it be down to getting an expert from Teamviewer to give evidence?
I could go down the route of also cross checking the IP addresses but as these are more variable and yet another concept to explain the the jury, I would far rather rely on the simplicity of the unique Teamviewer ID.
Hello!
Download the TeamViewer Manual here
Check page 11. It says the following
Computers can be identified worldwide by a unique ID. This ID is generated automatically based on hardware characteristics during the first start of TeamViewer and will not change later on. This ID is completely independent of your computer's IP address.
)
BUT
http//
Could it have been a "cloned" PC?
jaclaz
yes, thanks, I have the manual and have noted that section but relying on that alone can look a bit weak in court.
I like the point about a cloned computer. Teamviewer support say that the number is created using software and hardware settings as factors. I assume but, will have to check that they use Mac numbers or similar so that two identical PCs purchased off the shelf together will produce a different number. But then there is the issue of running a VM machine.
I am fortunate that there are other factors to rely on and sometimes I over think these things and end up coming up with a better possible defence than the actual one. But thats a good position to be in.
The link provided only really talks about generating a new one - not whether a clone would connect using the old ID.
Could you not just install TeamViewer on 3 machines (say A, B and C), change the ID on B to be the same as C and then try and connect to A using both?
I guess my question really is; does TeamViewer even let you connect using a "cloned" ID? If it uses an algorithm to create the ID from hardware & software identifiers, does it check the ID on start and not let you connect if there's a problem?
You're right - it is an interesting case D
at one end , the logs have been deleted but carved sections in drivespace are available, so another option is to take all of the avaialble logs for each pc and then produce a timeline so that where there is a match at either end re the connection time, the only explanations are that these two computers are connected or that "Computer A is connected to a clone of Computer B and Computer B is connected to a clone of Computer A" which given the context of the other evidence is pretty weak.
The link provided only really talks about generating a new one - not whether a clone would connect using the old ID.
Sure it doesn't. )
The idea was to expose possible weak points that should be verified by the OP.
jaclaz