A Way to tell when a computer was disconnected from the network?

[zinx]

Hey guys,

Two laptops were stolen from my office this weekend and I’m trying to do some sleuthing on my own because the cops aren't really going to be much help for $4k in equipment.

Anyway, the original time frame is between 5:15 on Friday evening and 3:30 pm on Sunday afternoon.

Then I was looking at the Symantec System Center console and discovered that one of the laptops returned a successful virus scan at 3:00am on Sunday morning (the other laptop was turned off). So now the timeframe for the theft is between 3:00am and 3:30pm Sunday.

Does anyone know a more specific way a computer went off the network? The machines that were stolen were both XP pro and our back end is Server 2003.

Thanks in advance.

 

[DaWiper]

Did the laptop have a email client running? Maybe you could check when the last time the laptop checked the server for mail? Could narrow the timeframe down some more.

 

[seadave77]

Is there a log file on maybe the router to see when the last time it renewed its IP address?

Clint

 

[zinx]

Did the laptop have a email client running? Maybe you could check when the last time the laptop checked the server for mail? Could narrow the timeframe down some more.

Thats a good thought, but i only see about the last 10 logins and they have all been today.

Is there a log file on maybe the router to see when the last time it renewed its IP address?

Clint

Thats a good idea too. I already checked the dhcp lease for the laptop and it is a 7 day lease that was obtained last wednesday, so wouldn't be up for renewal for a couple days.

Thanks for the quick reply guys, keep the ideas comming.