Absolute Investigations October Roundup: Device Recovery Success Stories

The Absolute Investigations Team has been working with Absolute customers to recover stolen laptops since 1995. In September, our investigators celebrated the significant milestone of 55,000 recovered devices! This group of professional sleuths rely on their law enforcement backgrounds to successfully navigate the circumstances of stolen property combined with the power of Absolute’s firmware-embedded endpoint defense platform with its undeletable digital tether to every endpoint, no matter where it is located.

With the Absolute platform, investigators also have the power to lock, freeze, or remotely wipe any device if it falls into the wrong hands. This valuable service has prevented damaging data leaks, reduced costly non-compliance risks and fines, and the unnecessary purchase of replacement hardware. Here are some of the investigators’ most recent highlights:

Courier Theft

Last month, this blog featured a recovery story from a children’s hospital in Arkansas, which had procured a new laptop online from Dell that was not delivered. Because Absolute’s undeletable digital tether is embedded within the firmware of Dell machines – and because this hospital is an Absolute customer – investigators were able to use Absolute forensic tools to discover the new user status. This month, the same hospital noticed a request for payment for another laptop that was never received, so they once again notified the Absolute Investigations team. Using forensic tools, investigators found an obscure email address that led to a name associated with the purchase, and the team employed geolocation tools to pinpoint an address a short distance away. Absolute prepared an Investigative Summary for local authorities and detectives connected with FedEx Investigations only to find out the delivery of the device had been assigned to the same FedEx employee previously identified, fired, and charged criminally for Felony Theft last month. Detectives found the device with the former delivery driver, and it was returned to the hospital. Additional charges against the former delivery driver are now pending.

Theft by Insider

A New Jersey city office reported that a laptop had been stolen from an AV cart over the new year holiday to its local police and to the Absolute Investigations Team. A burglary suspect was currently under arrest, but the suspect would not cooperate with authorities regarding the missing laptop. Using forensic tools, Absolute investigators determined the laptop was currently being used by a college student, so Absolute locked the device. Because the student needed to keep doing coursework, the device’s lock message resulted in a call to police. Detectives learned that the student’s father had purchased the device off the street and had no knowledge it had been stolen. The laptop is now being returned to the city office. 

Auto Burglary

An employee at a bank in Panama City was the victim of an auto burglary. During the break in, a bank-owned laptop was stolen. Absolute investigators were notified of the theft and discovered soon thereafter that the laptop was connecting from Ecuador. Absolute discovered the new user was a doctor dealing with COVID-19 issues and patients. While a device freeze could be implemented, investigators instead spoke with their bank client in Panama and together decided that action wouldn’t be in the best interest of the doctor’s patients. Instead, the new user was contacted via email and WhatsApp. The doctor responded to one of the messages and explained that he had purchased it online without knowing it was stolen. He agreed to return the device and worked with investigators on shipping arrangements. The laptop has been safely returned to the bank.

Office Theft

A laptop was stolen from a city office in Pretoria, South Africa and Absolute was notified. Investigators initially had to sort through a significant amount of information to determine who the new user was because he was using the device to create multiple dating profiles using fake information. Eventually, though, the user logged into his real Facebook profile to start communicating with a family member. That login, along with the device’s Geolocation details, gave investigators the insight they needed to find the new user and the information was provided to local authorities. Detectives followed up and seized the laptop, which was then returned to the city office.

Also read: Absolute Investigations September Roundup

For more than 25 years, Absolute Investigations has helped organizations recover their stolen devices. Made up of former law enforcement professionals and other experts, Absolute Investigations uses forensics tools and techniques to locate devices at large and once found, they connect with local law enforcement to orchestrate their safe return. Learn more here.