locked
Law Enforcement Technical Question: Computer Apparently Stolen During Backup RRS feed

  • Question

  • I'm trying to track down when a computer was stolen. Apparently it was being backed up by WHS at the time it was stolen.

    The "Network Status" indicator notified me that the stolen computer's most recent backup failed, due to "The network connection between the computer and the server was lost. No reconnection within timeout period." This leads me to believe it was stolen (disconnected from the network) during an actual backup.

    I checked the event logs on the WHS, and it indicates when the backup for that computer started, which coincides with the "Time" on the backup details for the Failed backup in the WHS console, however it also indicates that the backup finished about 2.5 hours later. There is no record of the backup failing in the event log.

    My question is:
    a.) Is there any way to see exactly when a backup started to fail, i.e. when it was first disconnected from the network? (Since there is mention of a "timeout period" I can't be certain the time the backup "finished" is when it was disconnected from the network.)

    b.) What is the "timeout period" that I could reasonably subtract from the backup "finished" event in the event log, thus giving me a time when the computer was first disconnected from the network.

    Thanks so much, I'll be monitoring this post. I didn't know who else to turn to for such a detailed/odd question.

    Thursday, January 3, 2008 9:16 PM

Answers

  • Have a look at the eventlogs of the WHS: connect to WHS using RDP or KVM, Start, Run, type Eventvwr.msc and hit Enter.

     

    Other place to look is WHS backuplogs. You can find these in C:\Documents and Settings\All Users\Application Data\Microsoft\Windows Home Server\logs on the WHS.

     

    Good luck!

    Thursday, January 3, 2008 9:35 PM
    Moderator

All replies

  • Have a look at the eventlogs of the WHS: connect to WHS using RDP or KVM, Start, Run, type Eventvwr.msc and hit Enter.

     

    Other place to look is WHS backuplogs. You can find these in C:\Documents and Settings\All Users\Application Data\Microsoft\Windows Home Server\logs on the WHS.

     

    Good luck!

    Thursday, January 3, 2008 9:35 PM
    Moderator
  • I had checked the event log on the WHS server previously.  I'll check the backuplogs now.

     

    Thanks!

    Thursday, January 3, 2008 9:41 PM
  • Got it, thanks!

     

    1/1/2008 5:16:18 AM  10c] Error 10054 receiving data from partner
    [1/1/2008 5:16:18 AM  10c] Breaking TLS sesssion...
    [1/1/2008 5:16:18 AM  10c] Read 0 bytes, hr=80072746
    [1/1/2008 5:16:18 AM  10c] ReconnectableStream: Read failed, reconnecting {A9F4F5EC-0A1E-4933-8391-2D1FAF5FD6D2}, generation 1
    [1/1/2008 5:16:18 AM  10c] ReconnectableStream: Awaiting reconnection for session {A9F4F5EC-0A1E-4933-8391-2D1FAF5FD6D2}

    Thursday, January 3, 2008 9:51 PM
  • We have developed a database to track your personal assetts. why not use it first before your asset gets stolen. We hope you like it; its completely free and designed for the community.

    Assettmate.com is a new database enabling people to enter details of assets they have purchased, whether new or second hand. This means that in the event of theft or loss of their precious item, the asset can be tracked by means of the serial number. By logging on to the database you can enter all relevant details of your asset, including photographs, so that you have a record for insurance and warranty purposes. Should you wish to sell the item, you have all relevant details at hand.

    The process is simple: when you purchase an item you will be given a serial number for the goods purchased. Enter the details on www.assettmate.com and any other particulars that are useful to know, such as date of purchase and vendor's details. You will no longer need a filing cabinet full of messy paperwork and at last you will feel organised and secure, knowing details of your precious possessions are safely stored. Assettmate.com is free for all users.
    Sunday, May 10, 2009 7:54 AM
  • Hello, I have put my laptop and desktop into assettmate.com thanks. Can I sell things as well on it?

    Sunday, July 26, 2009 8:02 AM