Catch a Laptop Thief with Prey

I had a laptop computer stolen several years ago. I wrote about the robbery at the time at http://blog.eogn.com/eastmans_online_genealogy/2006/11/i_wuz_robbed.html. Luckily, I had a full backup of the laptop's entire hard drive stored on an online backup service, so I didn't lose any data. However, I suffered the indignation of my property being "ripped off" and also the possibility that someone could steal the data I had stored on the laptop. (The laptop was well secured with a user name and a lengthy password required to access the data on the hard drive, but a knowledgeable thief probably knows how to overcome that).

Experience is a great teacher. I decided to look for a laptop recovery program that would periodically report my laptop's whereabouts via the Internet. If stolen, I wanted to find out where my laptop was, assuming that the thief had powered it up and was using it. I believe that I found such a program.

Prey is a simple and lightweight program that will help you track and find your laptop if it ever gets stolen. It works on all operating systems.

Prey helps you find your stolen laptop by sending timed reports to your e-mail address with a bunch of information describing its whereabouts. That information includes the general status of the computer, a list of running programs and active connections, fully-detailed network and wi-fi information, and a screenshot of the running desktop. It won't send the latitude and longitude since your laptop has no way of determining that. However, it will send the I.P. address assigned and enough information about the network connection that the network's owners can probably tell police where the laptop is located.

Best of all, if your laptop has a built in webcam, Prey will even take a picture of the thief while he or she is using your laptop and will send the picture to you as an attached file on the e-mail report. I imagine the police authorities will be very interested in that picture! All Macintosh laptops have built-in webcams, as do many Windows systems.

When you install Prey, you specify an email address and optionally a URL (i.e. http://mypage.com/stolen_laptop). You can use the web address of your current blog or any web site that you currently own. Prey runs at a specified interval and checks the URL you previously defined. As long as that URL does not exist, Prey goes back to sleep. However, if the URL exists, Prey will gather the information and send it to the email address you specified. You can specify any e-mail address.

If you don't own a blog or web site, you can still use Prey. Don't put anything in the URL field during the configuration. The only difference is that the report will now be sent each time Prey runs.

Of course, Prey needs to have an active Internet connection to send the information. If the computer isn’t connected, Prey will attempt to connect to the first public Wifi access point available.

You may be thinking “but what’s the point of this program if the guy will probably just format the thing right away?” You’re completely right. However, experience shows that thieves tend to first look in stolen computers for valuable information, so there’s a good chance you can catch the thief before he or she reformats the laptop's drive. There’s even been some successful recoveries of laptops already. See http://www.geek.com/articles/apple/thieves-caught-on-stolen-macbook-webcam-20080513/ for one such report.

I installed Prey on my Macintosh laptop yesterday. The installation was simple, about the same as installing any other Macintosh application. The installation instructions for Prey state that if you install Prey on Windows XP or an earlier version of Windows, you need to make sure you have the .NET framework installed. .NET is already pre-installed on Vista and Windows 7. There is no pre-requisite software on Macintosh.

When I configured Prey, I specified a web page on this newsletter's web site: http://www.eogn.com/stolen-laptop/index.html. That page does not exist today. As long as that page does not exist, Prey will never send a report. However, if my laptop is ever stolen, all I have to do is create a simple little page at the address. After that, if the thief connects to the Internet or if the laptop finds a wi-fi connection, it will detect the new web page. I will then receive an e-mail report within a minute or two, probably complete with a picture taken by the laptop's built-in webcam. I will then probably forward the e-mail report to the police.

Just for an experiment, after installing Prey I created a simple web page at http://www.eogn.com/stolen-laptop/index.html. I rebooted the laptop, and about a minute later I received an e-mail message in my regular e-mail account, reporting a list of running programs and active connections on the laptop, fully-detailed network connection information, and a screenshot of the running desktop. An attached picture of my face was included. In short, Prey worked as expected.

I then renamed the web page so that it will not trigger any more reports. However, if my laptop is stolen in the future, I will again rename the page, once again naming it http://www.eogn.com/stolen-laptop/index.html. I can do that from any Internet-connected computer in the world within a very few minutes.

I do have a second laptop and it runs Windows. I will install Prey on that. In this case, the laptop does not have a built-in webcam, so I won't get pictures of the thief in action. However, the rest of the information can still be very useful for recovering the laptop and hopefully bringing the thief to justice.

I hope that I will never need to use Prey. However, it is nice knowing that it is installed and ready.

Prey for Windows, Macintosh, and Linux may be found at http://bootlog.org/prey.

One more thing: Prey is available free of charge.

Comments

[Lois]

Wow, thank you for posting this information. I plan to tell my family & friends!

[Susan Daily]

What a coincidence. I just finished reading this front page newspaper article in the Kansas City Star today about how the local public library has retrieved its stolen laptops! "The tracing software, called Computrace, is permanently installed on each computer." Full article: http://www.kansascity.com/105/story/1232776.html

I thought it was a shame they made it public since I assume any future thieves now will reformat the hard drive first.

[Bob B]

I presume by "user name and lengthy password" you are referring to the operating system login credentials. They are only used for access to the operating system and do nothing with respect to protecting the data on your hard drive. That data is probably not encrypted and can be easily read.

If you want to protect your data from a thief you need to encrypt it and also protect any place it might exist in unencrypted form such as hibernation and swap files. Details and options for doing this are very specific to each version of each type of operating system.

[Dick Eastman]

---> That data is probably not encrypted and can be easily read.

Correct. That's why I wrote the rest of the sentence: "...but a knowledgeable thief probably knows how to overcome that."

I do encrypt individual files that are sensitive. I don't have many of those but there's always two or three that I would prefer to keep to myself. There are a number of programs that offer heavy duty encryption these days and most of them are available free of charge.

- Dick Eastman