A mad question for you all

Puteq

OK folks i have what is a bit of a mad question someone asked me recently and i was not sure of the answer. i am going to transcribe it here and ask your opinions. the person who asked the qestions asked it in a hypothetical scenario, so i will post it here:

"imagine there was a big office with 2000 people in it and 200 printers
(for arguments sake the printers are all the same make) and one of the
employees was a murderer who printed "your dead" from his pc and printed
it and left it in his victims chair the day before he was killed if the police were to find this as a clue is there any way that they can
ascertain what printer it was printed from out of the 200 printers....
what im trying to ask is does every specific individual printer leave a
"fingerprint" specific to that printer that can be traced 100%
definitely to that printer, and also is there any way that you can track
which pc that it was printed from if they found the printer?"

dont worry i know the person and they are not a murderer so your answering this post wont be implicating you as an accomplice to a crime!!! my understanding is that if it was a case that it was a murder or something then possibly it would be possible to trace back (involving incredible amounts of examining computer logs etc), but it is the kind of thing that a normal network administrator wouldn’t do in a normal case. are there any programs to allow you to pull this kind of info in a report form? and if so, would many places have them??? I dont actually know why this person asked me this question but i am assuming they are just paranoid about how much their network administrator knows about their arsing around in work!

Chong

FFS what is this all about ??

Ri_Nollaig

printers make tiny mistakes that act like a fingerprint SO yes they could trace it back to the printer
and there will be a log of the users who printed off that printer as most places have some kinda username and log so they can trace each person and wat they r doing

good luck in your trail

Inquitus

Ri_Nollaig wrote:

printers make tiny mistakes that act like a fingerprint SO yes they could trace it back to the printer
and there will be a log of the users who printed off that printer as most places have some kinda username and log so they can trace each person and wat they r doing

good luck in your trail

Printers do have figerprints, so to speak, so the printout could definately be traced to the printer. Unsure as to whether the printer / print server would hold enough information for the person to be traced from the logs though.

Inqui

dub1dude

Try it an find out? Only messing don't do that!!!

Yeh you could trace it back to the printer, just like everyone's shoe print has different nicks in them to identify the shoe so also has the printer. So that is easy enough to do with the right examining equipment.

Each computer would have to have an IP address and all the printers would have their own IP address, so there should be a log on each printer and each computer of exactly what IP address tallked to another IP address at a certain time. But to locate the printer that got the message from a specific computer would be hard to do, but it would narrow down the search.

That would lead you to say 10 computers for arguments sakes, so unless your murderer was stupid enough to save the message "You're Dead" onto his/her hard drive then it would be virtually impossible to know exactly which one sent the computer.

But then those clever detectives start profiling the killers and associating the realtionship each person had with the victim and I'm pretty sure there would be some physical evidence on the victim or the weapon to associate it to the suspects. Therefore leading to an arrest.

Ta da!!!

deckie27

There is a product called encase Which would find the info required

Other wise the print spooler may have it cached

Dec

Kali

so there should be a log on each printer and each computer of exactly what IP address tallked to another IP address at a certain time

how convenient .. unfortunaly no such logs exist by default, while the vast majority of workgroup printers can be configured to log via syslog or snmp, its quite frankly a bit of a pain to setup... the same goes for workstations.

Puteq

cool thanks for your input people all very interesting. I was asking the person who asked me just why they wanted to know (getting kinda worried me!) but it was just one of those hypothetical 'what ifs'

having said that, when i was thinking about it, if i was the murderer, i would print to a specific printer, then change the toner with another printer in the building (one that i never print to), that way any 'fingerprint' would i reckon be tied to the toner rather than the printer itself. but now i am getting worried that i am thinking about this too much! Aaagh, change the subject!!!

by the way Willem D, what is FFS ? Oh wait i think i just figured it out from concluding what someone would say when asked a question like this...

DonkeyStyle \o/

Everyone knows you should spell out your death threat with individual letters cut from magazines with a scalpel... glue them onto a post-it for extra convenience.

Wandering Dazed

Windows based print servers by default log print jobs in the system log. The log specifies the time, user and document printed...

kasintahan

Yes, it can be done and easily. All printer mech's make tiny systematic mistakes. Those can tell one printer from another.

Also...
Is your printer spying on you?
See here: http://www.theregister.co.uk/2005/07/29/printer_spy_fears/