Employee suspicious

File ttimestamps are not 100% usefull either. If the user changed the clock, they can easily make it appear a job was started at one time and finished at another. This can reflect hours of time but because of clock time changing, could in reality be mere minutes. You can look at files and try to find info that provides the info you seek but unless there is a hidden log that tracks everything (including clock resets), all you may end up with is suspicion. No concrete proof.

its too vague anyhow.

say I am designing some code.

I *could* spend that time sitting at the keyboard, pounding keys, trying by trial-and-error to get the right match.

or I could take a pencil and some scratch paper, block out some ideas, throw away the ones that don't work, rough out the user interface and how I would like it to look - THEN start to try and code that.

a detailed log of timestamps would show when I was doing the relatively easy work of typing up what I spent hours designing.

or say I am building a word document. at 10am, I copy from a tempate I made four months beforehand, as it has some of the stuff I need already typed in.

for six hours, I pound keys, with a one hour break around noon, so its now 5pm

timestamp will show a file first created four months ago, last updated at 5pm.

now, suppose the job was *identical* to one I did four months ago, and only the company name need change.

I copy the file at 4:40, do a global replace, set it printing, have a cup of coffee, realise I haven't saved it yet, save it off, and.. am left with a file created four months ago, last updated at 5pm.

file creation and last updated stamps then, even if completely honest, don't have to tell you anything about how much work went into the file.

presuming that you are thinking though, there shouldn't be a whole lot of temp files in iexplorer cache of shopping web sites while you working though.

-gsgi

we are dealing with a receptionist, with a laptop she takes home, who is supposed to call and confirm patients for the next day from the system.  I doubt she is sophisticated enough to change the time.  I think she is dumb enough to have either had the laptop off, or have a lot of temp files while she was browsing.

thanks,
gsgi

hmm. that opens a completely different can of worms. is the data held on the laptop, or on a remote system the laptop dials into? would it be possible for her to print out a list of patients, rather than juggling laptop and phone at home? I suspect we should skirt around the hipaa requirements for patient data to be held securely when offsite.... :)

First question that comes to mind is your local privacy legislation, are you sure you're allowed to conduct a secret informal forensic investigation on her workstation based on suspicions alone? Assuming it would be legal, it still sounds like any information you'll be able to gather will be circumstantial at best, so what is your action plan based on your findings? Is your friend aware of the legal rights of the employee, and the grounds based on which she'd be able to fire her? Is the employee prohibited from using the workstation for her private stuff, such as personal email and surfing/shopping? Is it in her work contract, or in the company security policy that she has read and agreed to formally by signing it?

For reference, what you're doing would be illegal where I live.

Illegal here too, I think CoccoBill has the pulse, stop what your doing, and return the LT. There is plenty of software out there to log activities. Typically just talking to someone after you have evidence of wrong doing or ill advised behavior in the work place is enough to get them to straighten up going forward. Repeated offenses need to be dealt with stronger and stronger discipline.
Again if the laptop is part of a HIPAA compliant business, what your doing, and what your friend has done, is against the rules without question.
-rich

I found this link

http://www.privacyrights.org/fs/fs7-work.htm

are you guys in california?

Here is another.

Are you guys in the public sector?  This is a private sector case in Connecticut.

http://employeeissues.com/workplace_privacy.htm

Glad to see you have joined EE - I hope you like it here.  We do.