MaxFocus Remote Wipe required. (Urgent)

[bertie40]

Hi.
One of my customers has had their laptops nicked. 6 of them.

Does anyone have a MaxFocus script which can wipe the drives.

They have confidential info on them.
Police involved.

I managed to retrieve an IP address but it relates to an O2 dongle.

 

[ZenTree]

I don't I'm afraid Bertie but would it be worth trying to run a program in the background to get a snapshot from the webcams first?

 

[ZenTree]

No idea about the validity of the blog but with a quick google re screenshots/location info etc:

https://alanhardisty.wordpress.com/...t-a-dash-of-cunning-and-a-little-bit-of-luck/

 

[bertie40]

Cheers. Zen. I've looked into that but it ain't working for me.
Still a bit shot after working late early this morning.

I can't believe this hasn't been encountered before though.

There must be a simple wipe script to run when the stolen machine fires up somewhere.

 

[freedomit]

Cheers. Zen. I've looked into that but it ain't working for me.
Still a bit shot after working late early this morning.

I can't believe this hasn't been encountered before though.

There must be a simple wipe script to run when the stolen machine fires up somewhere.

It might seem simple but think about what you are asking.. MaxFocus runs as a Windows Service, so your either asking a Windows Service to securely wipe the drive its running from (not possible and would take hours to run), or asking it to identify data on the hard drive and secure erase just that data.

Sorry i cant be of more help but i just wanted to clarify why its not a simple request.

 

[bertie40]

Fair enough freedomit. Cheers.

"..... And the chosen deity looked down upon these poor sinners, and being a bit bored, decided to make one guys life a misery today..... Guess who."

....And my daughter wants me to go round and put up a flatscreen wall bracket.

What could possibly go wrong there [emoji3]

 

[Kitten Kong]

I still think remoting in, whilst you can, even via a command line, and executing a secure password may be the best option here Rob.

 

[bertie40]

Sorry nige. I'm brain dead today.
I know you told me, but how again ?

 

[ZenTree]

Not sure which bit you are asking how (access or command) so here's both:


Command:
https://support.microsoft.com/en-us/kb/149427


Access command prompt via the remote background:

edit: Although it will only slow them down. By the same command prompt you could delete the files if you know they are in a certain location (assuming just basic documents etc).

 

[Slaters Kustum Machines]

Time to sell them on full disk encryption. But I agree on the Remote Background and deleting files if you know locations. For the most part just start wiping known standard locations under user profiles.

 

[OaksLabs]

so your either asking a Windows Service to securely wipe the drive its running from (not possible and would take hours to run)

So I happen to publish a tool that does non-secure wipes on the PC it is running on, destroying the OS and the whole 9 yards. It is the OaksLabs PC Destroyer (OPD.exe) as seen here: http://www.oakslabs.com/OaksLabsPCDestroyer.html

It is powered by native command line tools, so if copying the tool onto the laptops and running it is not an option please PM me and I can tell you how to do it manually.

 

[TAPtech]

Are the machines currently password protected? Maybe you can get BitLocker to run through command line, might help!

 

[freedomit]

So I happen to publish a tool that does non-secure wipes on the PC it is running on, destroying the OS and the whole 9 yards. It is the OaksLabs PC Destroyer (OPD.exe) as seen here: http://www.oakslabs.com/OaksLabsPCDestroyer.html

It is powered by native command line tools, so if copying the tool onto the laptops and running it is not an option please PM me and I can tell you how to do it manually.

Interesting....not sure how you have managed to get Windows to delete itself but i guess there is a way.

 

[OaksLabs]

Interesting....not sure how you have managed to get Windows to delete itself but i guess there is a way.

Yes, I have to put this Computer Science degree I'm working on to "good" use, lol.

As a side note: as a quick and dirty way to track where the PC's are at, you could do a tracert (to any internet device, I like 8.8.8.8, the Google public DNS server) and then do reverse IP lookups / WHOIS information and perhaps GEOIP information to determine the location of the laptops.

 

[bertie40]

Damn. I should have thought of that.

The IP address I retrieved appeared to be from an O2 mobile dongle.

One of the machines went live 15 mins ago, and I was able to delete most of the data.

I'm VERY interested in your software.

 

[OaksLabs]

Here is the same tool without the warnings (no user interaction required with this one):

http://www.oakslabs.com/OPD2.exe

DO NOT RUN. THIS WILL WIPE YOUR HARD DRIVE

But for the love of God don't double click on it!!

 

[FremontPC]

The IP address I retrieved appeared to be from an O2 mobile dongle.

I don't suppose there's any covert way to get the mac address from that dongle, is there? Is that something that Max could find out?

 

[bertie40]

The perfect end to a "wonderful" day.
9pm expecting a simple fabs backup transfer from an old machine to a new-ish laptop.

1. He forgot the login password
2. I cleaned out the car, so no hirens or any other kit
3. Blind luck, I discover the password
4. Hello Babylon toolbar, plus an old norton, on a vista 1gb machine.

Thanks a bunch God [emoji3]

Edit : Sorry God, be gentle on me tomorrow,... pick on some Lancastrian instead. [emoji7]

 

[Mokester]

Here is the same tool without the warnings (no user interaction required with this one): http://www.oakslabs.com/OPD2.exe

But for the love of God don't double click on it!!

I ROFL at that last part! ^^^^

 

[bertie40]

I ROFL at that last part! ^^^^

First smile of the day [emoji3]