A few months ago a client of mine had a break in. The thieves stole his 1 year old iMac and various other items. After they talked to the police, they called me. They told me that the computer was taken but that they didn’t take the little box that was under it. Luckily for them, the “little box under the computer” was the backup of all their data, going back many months. I told them not to worry about their files, and that everything was stored on the backup drive. The next day I remembered that I had installed LogMeIn on the stolen machine and could remotely access the computer if it was online. I checked, and noticed it was online right then.
I immediately tensed up once I realized I could control the computer without the thief realizing it. The tenseness eased up a bit, and turned into excitement. This was going to be fun. As long as he stayed online, I could find his IP address which the police could use to trace his location. The thief was on Craigslist looking for new guitars. He didn’t want to spend very much money. My guess is he didn’t want to spend ANY money. I grabbed a screenshot. I decided to name this guy Heywood. As in Heywood Jalookatmynewcomputer. I don’t know why, he just seemed like a Heywood. Once the mouse stopped moving for a minute or so, I figured he walked away from the computer, so I checked his IP address. I grabbed another screenshot. Then I got an amazing idea; I could open up Photobooth which displays what the built in camera of the computer sees. I held my breath and launched the program. Boom, there’s Heywood. Heywood Jatakemypicture. Thank you very much, don’t mind if I do. I took a screenshot. I took another 3 screenshots accidentally because my fingers were shaking. Heywood liked seeing himself on the big computer monitor and smiled. Stupid Heywood. I also liked seeing Heywood on the monitor. I took another screenshot. I could see his face, his big tattoo, and his apartment. I took some more screenshots. Then I noticed two things: Heywood hadn’t made his bed that day, and I was seriously about to pee myself. Heywood finally figured out how to close the Photobooth app and I disconnected immediately.
I took a deep breath, and smiled knowing I was more than likely intellectually superior to Heywood. I waitied a few hours then checked again to see if he was online, but he wasn’t and had probably turned the computer off. I wondered if he figured out I was connected and got freaked out, or if I got away clean. I called the detective assigned to the case and told him I had pictures of this schmuck and his IP address. I emailed the pics and info to him. I figured it was a done deal, and Heywood was not going to get a new guitar any time soon. The detective said it could take up to 2 weeks to trace the IP address to a physical address because they had to get a warrant before they could call the internet service provider. I asked if all the stuff we had on this dude was sufficient to get the address right away, because in 2 weeks this machine was going to be wiped clean and probably out of the city. He said we’d have to wait for a warrant, thanked me and said he’d get back to me if they found anything.
The next day I checked for Heywood and he was online again. Today Mr. Jalookatmynewcomputer was renting a car for a friend. I took another screenshot. I got the name of the person picking up the car (let’s call her Cruella), her phone number and address. I called the detective and forwarded the screenshot to him. He told me that they knew Cruella, and would look into it. He asked if I had any other information and I told him that I was currently watching Heywood surf Craigslist again. I was feeling quite proud of myself at this point. I heard the detective yell to some people “hey, he’s on Craigslist right now!” I’m picturing a room full of people with screens everywhere tracking my main man Heywood as he looks for CARS LOCAL UNDER $5000. My mind is going crazy. Minority Report. Hackers. War Games. Do you want to play a game, Heywood? They thanked me once again and told me they would get back to me.
I didn’t hear anything for a few days and Heywood hadn’t been online. I called the detective again, and he said that they went to the rental car place that day, but Cruella didn’t show and no one rented a car with the name from the screenshot. He asked me if I had found anything new. I hadn’t, but assured him I would keep checking and grab what I could. Later that day, (armed with my newly dubbed Junior Detective status) I found Heywood online again. This time Einstein was entering his email address at vh1.com. Perfect. I took a screenshot. I had a HUGE smile on my face. I got on Hotmail and plugged his email address in the search box. Bingo. I’ve got his full name. Of course it wasn’t “Heywood”, but I didn’t care, because he’d always be Heywood to me. Heywood Jalookatmyemail. I called the detective and gave him what I thought was the last piece of the puzzle. He said that they still hadn’t heard back from the judge on a search warrant. I asked (in kind of an annoyed voice, I’m sure) why they couldn’t just do something based on my small but growing mountain of evidence? I’ve seen way too many TV shows where the bad guys get busted with MUCH less evidence than my bud Heywood. He told me they will do what they can, but it could take a while. My excitement had turned to frustration.
A few days later, the detective called me. They had gotten the warrant and got a physical address for the IP. I’m thinking “cue the theme music, here we go”. They had gone out to the location, but apparently it was an old man who lived alone (not Heywood), and they didn’t find anything on the premises. I asked him if they noticed if the guy had a wireless network. He said yes, he did. I explained to him that our perp was probably on the wireless network from a few houses away. He said that they couldn’t do a search of the area without another warrant and that he’d get back to me if they found out anything, but he had a stack of similar cases that he was working on at the moment and not to expect much. Awesome. Meanwhile, Heywood had completely disappeared from the internet, most likely because he formatted the computer and sold it. Nicely played, Heywood. Heywood Jalookatmenow.
I’ve got Heywood’s IP address, email address, picture and Cruella’s name, phone number and address, and we can’t seem to get him arrested. As of this writing, Heywood still hasn’t been convicted. The detective was able to bring him in for questioning, but Heywood said he was working on the computer for someone he didn’t know and had no idea it was stolen. Right. The detective knew he was lying, but apparently could not prove that Heywood knew the computer was stolen or had stolen it himself, even with all the information we had. He told me that Heywood had been moved up on his “watch list”. Right now Heywood is probably playing a nice new guitar on his unmade bed. But there is a happy ending. My client got a brand new computer with the insurance money, and all of their data was successfully recovered.
And Heywood, if you’re reading this, expect a WHOLE LOT of email very soon.