Absolute Investigations November Roundup: Device Recovery Success Stories

When planning for 2022 budgets, many organizations will build in money for new devices. Laptops often represent a sizable percentage of that budget for many, and no one wants to have to factor in added cost for stolen devices. Unfortunately, devices are stolen with regularity. And while the device itself is an expense, even more costly is the potential for the data found on it to be associated with a possible data breach. That price tag is much higher.

Absolute customers have an important resource to lean on when it comes to stolen devices. The Absolute Investigations Team has been recovering stolen laptops on behalf of the customers since 1995. They rely on their law enforcement backgrounds to successfully navigate the circumstances of stolen property, along with the Absolute firmware-embedded endpoint defense platform and its undeletable digital tether to every endpoint, no matter where it is located. This allows investigators to lock, freeze, or remotely wipe a device if it falls into the wrong hands.

Here are some of the investigators’ most recent recovery highlights.

School Thefts

A student at a school in Louisiana reported a laptop stolen from his book bag while it was in the gym locker room. The School Resource Officer reported the stolen device to Absolute investigators who then discovered the device had come back online and was being used under a new computer and host name. The new user was also periodically using a different hard drive. Despite attempts to evade detection, forensic tools revealed the user was logging into iCloud and viewing pictures of a school age male. These led to the discovery of a name and email address. Using Facebook data, investigators were able to identify the user as a current student and this information was provided to school officials, who confirmed that the student had, in fact, had opportunity to take the device. The matter was handled by the school and the device has since been safely returned.

A school in Queensland, Australia reported a laptop was stolen during a burglary. Absolute investigators immediately went to work, searching with forensic tools for any information on the new user. It soon became apparent this individual was viewing suspected images of child pornography so, once investigators determined the user’s name, email address, Facebook profile and geolocation evidence, they handed the details over to the National Center for Missing and Exploited Children. Once the current address of the new user was confirmed, the information was provided to the Child Protection Unit. A warrant was issued, and police have since seized the laptop and charged the identified user. Absolute informed the school that their device has been located and it will be returned once the investigation is complete.

Good Samaritan

A Good Samaritan in Alabama called the Absolute tip line when he located a device in the back of an old car while working as a tow truck driver. The device had a ‘stop sticker’ on it from Absolute along with a ‘property of the school’ sticker. Absolute investigators reached out to the local school to let them know the device had been found and arranged details for the Good Samaritan to drop it off to school officials. The device has since been returned and the school is very grateful. 

Warehouse Theft

A contracting company in Louisiana notified Absolute investigators of a laptop stolen from their commercial warehouse. Using forensic tools, it became clear that the new user was using the device to mix music. This person was also attempting to block tracking of the device. Eventually, the new user entered personal information on the device and investigators used those details, along with geolocation information, to determine the individual’s full identity and address. Local law enforcement officials got involved and relied heavily on the investigative summary that Absolute prepared for them. Detectives arrested the theft suspect and the device will be returned to the contracting company as soon as it is no longer needed as court evidence. Absolute investigators notified the customer of the recovery.

Insider Theft

Eight laptops were recently stolen from an IT store in Pretoria, South Africa. The company suspected an employee committed the crime and reported it to local police. When detectives interviewed the suspect, he confessed and told them he had sold all eight devices to a local pawn shop. At this point, Absolute investigators were notified so they could track down the devices. Forensic tools and investigators on the case have so far been able to recover three of the stolen devices.  

Also read: Absolute Investigations October Roundup

For more than 15 years, Absolute Investigations has helped organizations recover their stolen devices. Made up of former law enforcement professionals and other experts, Absolute Investigations uses forensics tools and techniques to locate devices at large and once found, they connect with local law enforcement to orchestrate their safe return. Learn more here.