intrusion in your PC - forensic evidence

Dear experts,

In case a person detects an intrusion in his PC (like a request to use the camera, a message pops up etc),

I understand that one should immediately disconnect from internet, restart and run anti malware.

But, using Windows 11 Home, in order to identify the IP of the intruder and get forensic evidence of the intrusion to eventually communicate to the police, what else should the victim do?

Asus S5606 said:

Dear experts,

In case a person detects an intrusion in his PC (like a request to use the camera, a message pops up etc),

I understand that one should immediately disconnect from internet, restart and run anti malware.

But, using Windows 11 Home, in order to identify the IP of the intruder and get forensic evidence of the intrusion to eventually communicate to the police, what else should the victim do?

Click to expand...

Your router might have logs that can show what IP's that have been active...
I dont think windows log connections..
But you can check some "IF" but dont count on it as its Home and probibly default install
if you have a windows Firewall log ON
Windows\system32\LogFiles\Firewall\pfirewall.log

Event Viewer might show something
Security log
System/Application

DNS cache might show recent lookups
CMD prompt: ipconfig /displaydns

ARP cache might show something
CMD prompt: arp -a

Current TCP/UDP connections
CMD prompt: netstat -ano


But your router log is probibly better if you have a log in the router

I compute as safely as I know how, and TBH, I don't worry about the "what-ifs". I truly don't think knowing the ip address of an intruder would matter because authorities won't and can't do a darn thing about it since the majority of hackers are from other countries and running through VPNs which makes the ip address worthless.

IP and time together gives a trail to follow. As for the police to actually do anything.... It depends.. If it's one attack out of a big problem.. then Europol might already have an open investigation and they get more clues.
So always report and give them as much as you can.
Even your own IP and time for the incident might help them.

Computers are getting malware, adware, and scams on a "massive" scale. The typical response is to get rid of it, changing passwords, etc., and keep going. If the malware was detected by your antivirus, it may be uploaded to the server, which could result in the AV vendor starting to block the infrastructure, the malware, and reporting the malware themselves, leading other AV vendors to do the same, all without you having to do anything. Your lack of damage also makes it harder to report to law enforcement authorities, who may be more concerned with more pressing cases. Your reporting may help them, but getting feedback or a satisfactory response from them may be a problem. @Marie SWE seems to have provided a starting point of how.

If you are being specifically targeted, such as by your evil IT ex, then this would be a different story. Or if you are reporters or political activists being targeted by states, this might be a different story as well.

I've installed multiple antimalware programs, and manually disabled all telemetry settings in every program, but I still find the safest option against any intruders is to wear 2 tin-foil hats for double insulated protection.

An IP address won't get you anything or anywhere with law enforcement. You need evidence that identifies a person of interest

echo2446 said:

Computers are getting malware, adware, and scams on a "massive" scale. The typical response is to get rid of it, changing passwords, etc., and keep going. If the malware was detected by your antivirus, it may be uploaded to the server, which could result in the AV vendor starting to block the infrastructure, the malware, and reporting the malware themselves, leading other AV vendors to do the same, all without you having to do anything. Your lack of damage also makes it harder to report to law enforcement authorities, who may be more concerned with more pressing cases. Your reporting may help them, but getting feedback or a satisfactory response from them may be a problem. @Marie SWE seems to have provided a starting point of how.

If you are being specifically targeted, such as by your evil IT ex, then this would be a different story. Or if you are reporters or political activists being targeted by states, this might be a different story as well.

Click to expand...

You nailed it

so true, 99.8% of all hacks is just malware and scam links sent in mass to millions in hope for 1000 or 5000 to bite the hook.
And the best AV out there is the person between the keyboard and the screen..
almost no AV in the world can stop a new good written(zeroday) piece of malware you click on.. and AV's for home usage always slip on zerodays

Lack of damage is a real pain in the butt in the corporate world, as it can take days or way longer to detect an intrusion of the hackers have gained so deep access so they can clean the logs.

and finally you nailed it again.. the only 0.2% have reason to worry for real.. If you are a target, then you have to take a few steps extra then a normal person.
Easiest for those who are and dont want to learn security... Device and network isolation, one or more for important stuff on one isolated part of the network.... and one for casual browsing on an isolated part of the network... and never-ever store personal information and passwords on that device... so if the device used online for just browsing the web etc. get compromised (infected/hacked etc.).. no real damage can be caused.

oh and yes... you almost never get feedback from the Police after you reported it,... unless you are working with them.. and even then you get poor feedback. *LOL*

idgat said:

I've installed multiple antimalware programs, and manually disabled all telemetry settings in every program, but I still find the safest option against any intruders is to wear 2 tin-foil hats for double insulated protection.

Click to expand...

Sure. but are those tinfoil hats grounded (or earthed)?

neemobeer said:

An IP address won't get you anything or anywhere with law enforcement. You need evidence that identifies a person of interest

Click to expand...

In some cases you are that person of interest. It wouldn't be a stretch to suggest that this very forum is being monitored.

Remember MAD Magazine's Spy vs. Spy? Yeah, it kinda works like that.

Scannerman said:

Remember MAD Magazine's Spy vs. Spy? Yeah, it kinda works like that.

Click to expand...

Sure do. It was a must-read when I was growing up. "The usual gang of idiots." Nothing like that today. And if there was something liike that, it would get shut down (at least n the USA.)

There is very little you can do once you have become a victim of a malware attack. The hacker would use a VPN and carry out his or her nefarious plan using a computer at an internet cafe. Things have gotten so bad that now there is plenty of malware software created just for sale or rent.

The creator of the app and the actual perpetrator of the crime will share the profits. This sort of malware is called ransomware. It is designed to corrupt all the files on your computer rendering them unusable. These dregs of society mostly target big corporations and would demand a hefty sum (ransom) in return for an executable or a password that would would return everything to normalcy.

You need to be pro-active. Use a decent anti-virus (free or paid) application and an anti-malware monitoring software like Unhackme or Malwarebytes.

Another way is to backup your OS and all the files on your other drives using a backup software before the attack. You then just need to use the rescue disk to restore your OS to the way it is before the tragedy happens.

If cost is an issue, just use Avast One (free) and a free giveaway version of Unhackme. And for backup, I suggest the free Hasleo Backup Suite.

Asus S5606 said:

Dear experts,

In case a person detects an intrusion in his PC (like a request to use the camera, a message pops up etc),

I understand that one should immediately disconnect from internet, restart and run anti malware.

But, using Windows 11 Home, in order to identify the IP of the intruder and get forensic evidence of the intrusion to eventually communicate to the police, what else should the victim do?

Click to expand...

you can disable all camera access in the browser settings along with microphone access.

security is in depth not just a single line of defence.
router firewall or hardware firewall
up to date firmware for the router

on the computer
software firewall
up to date security and system updates
good active AV/malware software
a good up to date browser

all internet connections on my systems use encrypted connections
HTTPS and DNS over TLS using my own resolving caching DNS server.

and last but not least a little bit of common sense.
even then if its a directed attack and not a drive by or hope and pray attack
any system can be compromised by a determined attacker.

best of luck, Steve ..

XxXxX said:

you can disable all camera access in the browser settings along with microphone access.

security is in depth not just a single line of defence.
router firewall or hardware firewall
up to date firmware for the router

on the computer
software firewall
up to date security and system updates
good active AV/malware software
a good up to date browser

all internet connections on my systems use encrypted connections
HTTPS and DNS over TLS using my own resolving caching DNS server.

and last but not least a little bit of common sense.
even then if its a directed attack and not a drive by or hope and pray attack
any system can be compromised by a determined attacker.

best of luck, Steve ..

Click to expand...

What I find ironic is older PCs getting harder to hack because standard venues of infiltration are no longer present.