Being set up to be sacked.
 

I have recently been suspended from work but expect to be back soon- nothing dodgy at all- but to " allow an investigation to take place".
I have learnt that some people have been 'working' on my computer (work owned) for some 2 weeks during my absence and lordy knows what they are doing.
I have warned that I am being set up to be sacked.
I can honestly state that there was nothing dodgy on the computer whatsoever when I left- but wondered if files could be 'backdated' onto my computer during my absence and then I get blamed and dismissed. If the computer clock and calendar is changed - is this the date shown as installation?
Is there any way to see when files were actually added despite clock etc being changed?
It might sound a tad paranoid- but I have worries.
Is there a way of finding out what's been looked at in the last 3 weeks?
Software?
Is there a way of finding what software might have been added and 'hidden'?

MS windows 7 os.
Thanks in advance.

I'm afraid it's quite easy to alter the timestamp of files using a version of the 'touch' command without needing to alter the computer's clock..

jimgriff,

I'm afraid you're just going to have to let events run their course.

The answer is "maybe, perhaps", but you probably don't have sufficient permissions on a work computer under your username to enable you to do the digging you need. Nor would any digging you do stand up in court because it would not be forensic.

By all means go for the employment tribunal if you feel aggrieved.

Be sure and get the names of any that have been working on your computer (log-ins etc.)

If they all work in the IT dept then there is no need for worry anymore.

If the computer has been compromised allowing the company itself to get hacked, expect the investigation will go much further without your assistance.

I'm not accusing you of anything but there is something you need to consider. If there had been anything on the computer that (in their view) should not have been there, and you deleted it before leaving, there are still plenty of traces of it that the IT guys can find. Could you find yourself in such a situation?

Or did you mean that there has NEVER been anything dodgy on your computer?

Hopefully it's the latter.

All the computers I ever took home from work had something dodgy on them at one time or the other that I wouldn't want IT to find. The best I could do was to keep a low profile so IT wouldn't have to dig deep other than a quick scan and delete.

Of course one could always accidently lose the computer.

I saw a high level manager get a new career assignment once when his computer froze up and IT had to dig deep to find the problem.

In this day and age I would opt to have two computers in my travels . One for work and one for my own use.

Maybe it's your anonymous PPRuNe account that's done it. Some work types just don't have a sense for anything and will be wondering why you don't post using your real name.

Not legally admissible, or at least very much unlikely to be so without a great deal of hard work and supporting evidence.

Booting from USB doesn't prevent you writing to the hard drive, does it !

A decent IT department will block USB boot anyway.

As I said, he shouldn't play detective unless he knows what he's doing. Let events play their course and follow normal procedures (employment tribunal etc) if he feels aggrieved. Leave Sherlock Holmes to those with experience.

It stops anything being written in the event log or registry. FOM.

Says who ?

You can write to the drive, therefore you can tamper with the event log, registry or whatever you like.

Booting off USB/CD whatever is in no way the same thing as a proper hardware forensic bridge.

if you have never been sacked or retrenched the prospect of it is terrifying.
once you have had all this happen though it no longer holds any great emotion.

if that was happening to me I would walk away and get a job somewhere else.

Thanks for responses so far.
It might be worth noting the following:

I have to have my job to pay mortgage- no job- no house.
I have a young family.
I cant just walk into a job that pays as well as this. I have been in post for 14 years.
I have no savings so cant fight them or employ IT forensic service. Its a stand alone PC not a laptop- we don't have an IT department.

Jim - while the usual combatants squabble here, may I wish you good luck. Do you have a union representation?

Yes likewise Jim. I wish you all the best for the future. Whilst it may prove difficult to win the fight to keep your job, I can attest that this development may actually result in opportunities that are an improvement overall.

You will face stress but remember that clouds really can have silver linings.

Keep us posted.

Best of luck
Exeng

I've been fired twice. The first was on a trumped up excuse to replace me with the son of the country GM, an 18 year old youth who wanted to live in CPT, had no experience in the industry, and turned out to be a disgrace to the company. I got a good package of both remuneration and benefits, and went on to far better things.

The second was when I engineered being fired from a company in which I was utterly miserable, and I derived even greater benefits in every sense of the word from the situation. Subsequently they asked me to go back and work for them as a consultant, thus on my terms and conditions, enabling me to continue to enjoy the core activity but not suffer the politics, backstabbing, and bureaucracy which had soured the job.

As someone else said, once it's happened, it holds no fear. Turn it to your advantage.

Unless the law has changed that would come under the heading of contrived dismissal. It matters not whether it is the company or one of their paid staff it still stands.

It will need clarifying but the perpetrator(s) could finish up at a tribunal and if proven could lose their job.

Would be interesting to see who warned you that you were being set up to get the sack. I think it's just employee speculation and nothing more as it is unlikely management would speak that way.

If the worst happens lodge a claim with the work tribunal straight away, you can always cancel later. If you do take it to tribunal you have to be really honest with yourself and expect both sides to come out slightly compromised, with the loser more compromised than the victor - that's how they operate. 14 years does hold significant weight at a tribunal if your record is clean.

In my sacking it came out in the tribunal wash that the HR manager got onto the phone to a lawyer straight away after a homo executive whom I've never seen or met decided he wanted to get rid of me. Of course the lawyer would say sack me as he would make a lot of money out of it - thereafter the rest was just a bogus charade. I received serious legal threats prior to the tribunal which I ignored. During the tribunal the lawyer was clutching at straws who if not attacking my personality would be looking at technicalities in the legislation - he even requested leave (delay) from the hearing. But representing myself I got 'em good and they coughed up loads of dollars - I made the 2% category.

Besides the win over 3 totally useless pieces of **** (lawyer, HR, executive), the experience was quite harrowing as I'm an engineer not a lawyer. I was always willing to drop the case had I found employment but my reputation had obviously been tarnished.

The most (apparently) innocent things can come back at you. While working at College, I ran a work safety course which included safety wear and uniforms. I accessed nurses uniforms as part on the project and was banned from my work computer for a week!

Were they wearing them at the time?


:uhoh:

Probably not - but he might have been.... :ooh: