NotQuiteLeet.com

Undercover recovery story

Taken from Orbicule.com. The site was down and notquiteleet.com is acting as a mirror.

Below you can read a true recovery story. Events are in chronological order to give our (prospective) customers an idea of the recovery procedure (all times are EST). The owner’s name has been changed, to protect his privacy. This page will soon be updated with more recovery stories.

July 12 2006

8:15 PM

John’s Undercover-enabled MacBook Pro was stolen at his golf club, just a few miles from where he lives, somewhere in North Carolina, USA.

July 13 2006

01:29 AM

John contacts the Undercover recovery center and sends us the Undercover ID for his stolen laptop. Our recovery center immediately takes action and registers the Mac as stolen.

5:23 AM

John forwards us the phone number and contact information of his local police station, as well as the case number. This information will be crucial for us to work with the police and the ISP.

7:48 AM

Less than 12 hours after the theft, the thief connects the stolen MacBook Pro to the net. Within the first minute of network connection, Undercover sends all network information to our recovery center. This information includes IP addresses for the machine and the router, as well as date and time of connection, and the ethernet MAC address.

Our recovery center contacts BellSouth, the ISP of the thief and sends them all information, together with the contact information for the police and a case number.

7:54 AM

Just 6 minutes after the MacBook was connected, our recovery center receives snapshots of the thief, taken with the MacBook’s built-in iSight camera. The iSight camera really is a great tool for identifying the thief. The iSight pictures we receive clearly show the current user of the MacBook, most likely the thief himself (later, we received confirmation that this was indeed the thief).

At the same time, we receive screenshots of the stolen Mac. These screenshots clearly show that the thief tries to erase as much personal settings as possible. He starts by removing the desktop picture (showing John’s children). Then, the thief deletes all contacts (from Address Book) and all emails.

4:23 PM

We inform the police department that we have received information from the stolen laptop. We tell them that Bellsouth will contact them and give them the real location (postal address) where the stolen Mac is being used. We also send them the iSight pictures, which will aid in identifying the thief. Moreover, the iSight pictures are always a great incentive for the police to give the case a higher priority.

In the meantime, we keep receiving network information, iSight pictures and screenshots, confirming that the stolen MacBook Pro is still used at the same location and by the same person. Now that the thief has removed most personal files from the Mac, he starts playing games (see below) and watching porn (not shown here).

6:58 PM

We contact John to give him an update on the current situation. We ask him to contact the police in order to put additional pressure on the case because we feel we have a very high chance to recover the Mac if the police quickly acts on this case.

8:37 PM

Based on the information we have gathered, BellSouth gives the police the address at which the stolen Mac is being used.

10:42 PM

We keep on receiving interesting screenshots, showing the current user’s personal information. The screenshot below reveals his Yahoo email address.

July 14 2006

10:14 AM

We get confirmation from the police that they are working on the case and obtaining a search warrant, based on the information shared by Bellsouth and by our recovery center.

4:02 PM

We receive confirmation that the police has entered the thief’s house at the address provided by Undercover. The MacBook Pro was recovered in the same condition it was in when stolen, only 3 days ago. A couple of hours later, John sends us a thank-you email and we assist him in recovering the deleted files. We also unregister John’s MacBook Pro.

Conclusion:

This story nicely illustrates the general procedures followed by our recovery center in case of theft. Thanks to a swift police intervention, we were able to recover John’s brand new MacBook Pro within 3 days. Although some other cases differ slightly (or entirely), most cases follow this general outline. This page will be updated with more recovery stories in the near future.