Join Us!

Reporting question
 
Notifications
Clear all

Reporting question  

  RSS
jblakley
(@jblakley)
Active Member

All,

I was given a computer to analyze, but was told upfront that someone else had logged into the profile to 'look around'. When they didn't find anything, they brought it to me. Should I put that in the report? All of the timestamps are off in relation to when the true person last logged in versus the last person.

Thanks…

Quote
Posted : 10/02/2015 7:42 pm
jaclaz
(@jaclaz)
Community Legend

Should I put that in the report?

Well, what would be the alternative, hiding/failing to mention such a vital piece of information you were made aware of? ?

jaclaz

ReplyQuote
Posted : 10/02/2015 8:00 pm
jblakley
(@jblakley)
Active Member

I wasn't sure. Personally, I haven't run into an issue in the past where someone actually told me someone else had logged in. With that information, I would assume full transparency, but I wanted to get other opinions…

ReplyQuote
Posted : 10/02/2015 8:18 pm
jaclaz
(@jaclaz)
Community Legend

I wasn't sure. Personally, I haven't run into an issue in the past where someone actually told me someone else had logged in. With that information, I would assume full transparency, but I wanted to get other opinions…

I don't get it.

Possibilities are that the system (or filesystem or *whatever*) was (you choose)

  1. noticeably modified by *something* or *someone* that is not the "true person" AND you know (because someone told you) that it has been accessed by *something* or *someone* that is not the "true person"
  2. noticeably modified by *something* or *someone* that is not the "true person" BUT you DO NOT know (because noone told you) that it has been accessed by *something* or *someone* that is not the "true person"
  3. seemingly (or as far as you can see) not modified BUT you know (because someone told you) that it has been accessed by *something* or *someone* that is not the "true person"
  4. seemingly (or as far as you can see) not modified AND you DO NOT know (because noone told you) that it has been accessed by *something* or *someone* that is not the "true person"
  5. [/listo]

    In case of issues (of *any* kind) you can possibly claim having made a mistake or omission in "good faith" in case #4, and possibly in case #2, BUT NOT in case #3, let alone #1.

    jaclaz

ReplyQuote
Posted : 10/02/2015 8:48 pm
keydet89
(@keydet89)
Community Legend

Should I put that in the report?

Without a doubt. I would, but I would do so only as far as I could demonstrate through the data. I tend not to rely on what someone told me as "fact", in part because many times what one person refers to as "nothing" is actually quite a lot from a DF perspective.

What I might do is give the facts of the login (log entries, etc.) and then state that someone not the user in question had _reportedly_ logged in.

ReplyQuote
Posted : 10/02/2015 10:58 pm
jaclaz
(@jaclaz)
Community Legend

Without a doubt. I would, but I would do so only as far as I could demonstrate through the data. I tend not to rely on what someone told me as "fact", in part because many times what one person refers to as "nothing" is actually quite a lot from a DF perspective.

What I might do is give the facts of the login (log entries, etc.) and then state that someone not the user in question had _reportedly_ logged in.

Welcome back Dr.House! D

http//house.wikia.com/wiki/Everybody_lies

wink

jaclaz

ReplyQuote
Posted : 11/02/2015 5:11 pm
athulin
(@athulin)
Community Legend

All,

I was given a computer to analyze, but was told upfront that someone else had logged into the profile to 'look around'. When they didn't find anything, they brought it to me. Should I put that in the report?

It's better that you state what input you received for the assignment, than leave it to someone else to imagine. Murphy rules anything will be misunderstood, sooner or later. Much better that you pre-empt any speculations that may arise.

I usually have to discover that someone 'just looked around a little' for myself … but it goes into the report, no matter what the customer says..

ReplyQuote
Posted : 11/02/2015 8:33 pm
AshishSingh
(@ashishsingh)
Junior Member

Hi,

The best part would be to mention every piece of info right in the beginning.
If no such issue occurs, then that's fine. But if occurs then you will be on the safer side as you did already mentioned all the details.

Regards

ReplyQuote
Posted : 12/02/2015 9:57 am
Share: