ASG Advanced Surveillance Group, Inc.
logo_b

Computer Security

Computer Security

By Kevin J. Ripa
Private Investigator
Computer Forensic Investigations Director
Advanced Surveillance Group

In an ordinary world, people recognize their limitations. An ordinary person with no flying experience would never think about hopping into the cockpit of a 747 and flying it across the ocean. This is just common sense. Unfortunately, the computer world is anything BUT ordinary. It is fascinating that we would sit down in front of the most technologically advanced piece of equipment ever devised for personal use, and start using it, completely oblivious to such trivial matters as security, let alone proper use and understanding. Many of us get away with it, suffering from lockups, accidentally deleted files, and the odd virus infection or other security compromise. This does not need to happen, but sadly it does all too frequently. Why? Well here is my theory. The manuals and other training material provided for computers seem to be written at a level that assumes we have a strong understanding of how this silly box works and the terminology that goes with it. Unfortunately, by the time you are able to understand what the book says, you don’t need the book anymore. This forces most users to toss the book, forge blindly on, and hope for the best. Well suffer no more. You are about to learn about this very important topic in language that the rest of us can understand. We will also provide resources and information to pursue the topics further if need be.

Computer security is the most important, if not most ignored part of business computing. The problem does not lie in apathy. Those that know about it are attempting to implement it, but there are many that have no idea what the risks are or what to do to stop them.

Before you start worrying that this will be geared towards large corporations, let me tell you that the complete opposite is true. This information is geared for the rest of us in the setting of a home or single office computer, as well as any small office setup consisting of up to ten computers. Let’s start with exploring the more common risks that exist.

To spread their product, Virus creators count on millions of users doing something that they would never do in the real world – Open their door to strangers. They prey on users that don’t understand how Viruses are spread, inadvertently sending Viruses to everyone they know. By taking a few simple precautions, we can all make accidentally sending and receiving Viruses, a thing of the past.

95% of all Viruses, Worms, and Trojans are written to work within the Windows environment and the Outlook and Outlook Express programs. Why? Because the creator can be sure of doing the most damage. This doesn’t mean however, that we should all run out and change our operating systems to Linux or Mac, nor do we need to subscribe to AOL to avoid the largest bulk of malicious emails. What we need to do is understand the risks that are out there and the methods by which they propagate.

True immunity to Viruses doesn't exist. Just as it's hard to stop a crime before it happens, it's difficult to halt a Virus before it damages at least a few computers. However, just as you can take steps to minimize your risk of becoming a victim of crime, you can minimize your risk of becoming the next victim of either a malicious program or data loss.

There are three main threats within email messages and attachments. They are Viruses, Worms, and Trojans. For the most part, any malicious program/file you receive will fall into one of these three types. Keep in mind that these are not the only threats, but they certainly are the most common.

Viruses – Defined

To be defined as a Virus, a program must replicate itself in order to carry out a mission, be dependent on a "host" to carry out the mission, and create damage to the computer system "infected". A Virus is a program that reproduces itself, hides in other computer code without permission, and does nasty or undesirable things not intended by its victim.

A Virus cannot replicate itself and be sent to others without you telling it to. (Even though you do not know you are doing it). In other words, a Virus can only be spread through the users’ own intervention.

Viruses are considered a low level threat because they can not sneak into your system. They must come either on a disk someone has given you, or through an email with an attachment. An attachment is a file that comes with an email, like a document or a video clip. When you receive email with an attachment using Outlook Express or Outlook, you will see a paper clip in the upper right-hand corner of the email box. When you click on the paper clip, you are shown the name of the attachment, and given the option of either opening the attachment, or saving it somewhere else on your computer. To carry a Virus, the attachment must have an executable file extension like .exe, .com, .vbs or .pif. The only exception to this rule is a Macro virus, which will have a .doc extension. You cannot get a Virus through email by simply reading the email. You must open the attachment to activate it. Beware email programs that auto-open attachments!

As you can see, you didn’t just “get” a Virus by accident. You had to let it in. You would not think of opening the door in the middle of the night without first knowing who was there and what they wanted. A Virus cannot hop from computer to computer by itself. You have to send it out.

Worms - Defined

A computer Worm is a reproducing program that runs independently of other programs and travels across network connections (i.e. your Internet connection through email). The main difference between Viruses and Worms is the method by which they reproduce and spread. A Virus depends on a host file, files transferred between machines to spread, while a Worm is completely independent and spreads through network connections. Worms are delivered from within the email message. You do not need an attachment.

Typically, just reading the email can enable the Worm on your system. Because the Worm is a program with its own protection system (the message that fooled you into opening it in the first place) as well as its own executable damage program, it doesn’t need any external source such as an attachment. When a Worm gets into your computer, the program automatically finds the address book in Outlook and/or Outlook Express and sends itself to all your email addresses. You didn’t even know it was there. Having said this, there is little point to a worm by itself. You usually see Viruses attached to them so that when the worm automatically propagates, it takes the Virus with it.

You have two different formats to choose from when sending email: HTML Format or Plain Text Format. (In the case of AOL and Outlook, you have an enriched plain text option as well.) Worms propagate only in an HTML format environment.

You can receive an email in HTML format that looks no different than an email in Plain Text Format. That’s because the author has placed only text in the HTML format email. HTML format is what allows an email to look like a webpage, if the author wishes. Worms would NOT spread if everyone sent their messages in Plain Text Format.

Trojans - Defined

A computer Trojan is a malicious computer program disguised as something useful. The major difference between Viruses and Trojans is that Viruses can be reproduced, while a Trojan is a one-time program, which executes (usually) as soon as it’s activated. Trojans are the most common method of gaining unauthorised access to your hard drive. Trojans are considered the highest risk because you can get one and never know it. A Trojan allows intruders to access the Internet, email, and newsgroups through your computer. Any trouble they cause, looks like it came from you. A Trojan can come in to your computer attached to an email or embedded in a self-executing link in an HTML email. Plain Text emails cannot carry a Trojan. They must come in an attachment.

More so than ever before, hoaxes abound. Some promise cars from Honda, and some talk about the mother of all viruses. A virus CANNOT work in Windows AND Macintosh AND Linux, etc, etc. This is the first clue to a virus hoax. The text will indicate that the virus will wipe out any of these systems. A virus must be written for a specific program or operating system. It can’t cross over. Just RECEIVING an infected attachment CANNOT activate a virus. You must open it for the virus to execute. If you delete it without opening it, you will be safe. Having said that, Outlook and Outlook Express automatically open attachments in emails unless you have specifically taken steps to stop this. A virus CANNOT trigger “the reformat command” within Norton Utilities or McAffee. This is a big scare tactic being used. Norton and McAffee do NOT have reformat commands.

Viruses are the most difficult to stop on their way in, suggesting that you feel the need to open attachments. Do not send attachments unless you have to. If you have typed something in a Word format to send through email, cut and paste the entire article directly into the body of the email. Thus, no attachment. Sometimes we don’t have the choice. We need the attachment. Other times, we get an attachment and open it without thinking. Why would you open an attachment from someone you don’t know? Or even an unexpected one from someone you know. How hard is it to reply to the message, and ask the sender if he/she sent you an attachment? Or scan it with a good Anti-Virus program? This way, you can warn him/her as well. There is NO replacement for a good Anti Virus program and some good old-fashioned common sense, and we will address both shortly.

One of the most important things you can do, and has applications all over your computer and not just email, is to enable the showing of file extensions. File extensions are usually 3 letter monikers (but can be 2 or 4) that follow a file name (i.e. .doc). These extensions tell Windows what type of file it is so that Windows knows what program to use to open it. For example, if the file extension is .jpg, the computer won’t try to use Microsoft Word to open it. In order to better explain this, allow me to make you familiar with some of the more common file extensions and what they mean.

  • .doc-tells Windows that this is a document text file and to use Microsoft Word to open.
  • .exe-this is an executable extension. This means that the file is a PROGRAM. (IMPORTANT)
  • .com-once again, an executable program file, but usually at a DOS level.
  • .txt-typing of words only.
  • .vbs-Visual Basic Script (VERY IMPORTANT)
  • .pif- Program Information File.

I have not explained all file extensions because there are over 7000 of them and you will never see most of them. But you should familiarize yourself with the more common ones. If you have forgotten what one means, or if you see one that I haven’t defined, you can go to http://www.webopedia.com/quick_ref/fileextensions.html and look it up. You may be asking yourself, “What have these got to do with me?” Let me explain. Now that you know that .doc is a Word file like a report, when your co-worker sends you something that is supposed to be a report, and you see that the extension is .exe, you should know that something is wrong because .exe is a program execution file. Many of you are looking at your computer and thinking, “I don’t see these extensions of which he speaks.” All you see is the report you typed named “The Wonderful World of Widgets”. All your files look like this because you don’t have the showing of extensions enabled. Once you do, that file will look like this – “Wonderful World of Widgets.doc”. Now you can easily identify it by the .doc telling you that it is a document. First I will explain why this is important and then I will explain how to change your settings to show them. Having said that, remember that even a trusted incoming .doc file should be scanned because it could have a macros Virus embedded in it from the sender’s computer who isn’t even aware of the infection!

.vbs is the file extension for Visual Basic Script. The ILOVEYOU and NIMDA Viruses, among others had this extension. It needed the program on Windows that opens .vbs files in order to operate. With the first permutation of the ILOVEYOU Virus that came out, it was named ILOVEYOU.txt.vbs.

Unfortunately, this was done purposely under the assumption that most people don’t have file extension viewing enabled. Because of this, all you saw was ILOVEYOU.txt. The .txt was not an extension, but rather it was a part of the title that was typed that way to fool you into thinking that it was a .txt file. It was geared towards people who know just enough about computers to be wary of receiving an unsolicited file and had an idea that a .txt file was merely a text file, and so not very dangerous. It worked. If you had showing of file extensions enabled, you would have seen the .vbs and even though you may not know what .vbs stands for, you should have thought it odd that there were what appeared to be 2 file extensions. This seems to be the M.O. of many Virus writers now. At no time did you stop to think that you didn’t have viewing of extensions disabled so why would you see the .txt extension at all? Do you see the importance of file extensions? To show file extensions:

  • Win 2000 Pro, ME

    1. Open your Windows Explorer. This can be found by clicking Start/Programs/Accessories/Windows Explorer. It has an icon that looks like a file folder with a magnifying glass on it.
    2. Once this is opened, go to the menus at the top and click on Tools/Folder Options/View. Now you will see a list of instructions with little boxes beside them. Some will have check marks in them and some won’t.
    3. Find the line that says “Hide file extensions for known type files”.
    4. Remove the check mark in the box. While you are there, check “Show hidden files and folders” and uncheck “Hide protected operating system files”.
    5. Click Apply.
  • Win 98, 98SE

    1. Open your Windows Explorer. This can be found by clicking Start/Programs/Windows Explorer. It has an icon that looks like a file folder with a magnifying glass on it.
    2. Once this is opened, go to the menus at the top and click on View/Folder Options/View. Now you will see a list of instructions with little boxes beside them. Some will have check marks in them and some won’t.
    3. Find the line that says “Hide file extensions for known type files”.
    4. Remove the check mark in the box. While you are there, check “Show hidden files and folders” and uncheck” Hide protected operating system files”.
    5. Click Apply.

    Now, any files that are anywhere on your computer will have extensions after the names. Also, when you get an attachment to an email, you will be able to see by clicking the paper clip, the FULL name of the file. So if you get a file that is supposed to be a .doc file and you see .doc.exe at the end, you know something is wrong.

    There are two very important things you need to do to avoid getting ANY .vbs worm/Virus combination. First, you can click on Start/Windows Update and it will take you to a website where you download all of the Microsoft bug patches and security fixes as they come out. You can also download from there, a Critical Update Notification. This will automatically inform you when there are new fixes of ANY type for Windows operating systems. If you do this religiously, you won’t have had a problem. The patch for the security hole exploited by .vbs script was out about 3 weeks before the actual ILOVEYOU Virus came out.

    Whenever you double-click on a Windows file, an action associated with the file's format occurs. The default action for double clicking on a Visual Basic Script file--for example, the NIMDA virus--is to execute, or open, the script contained in the file. This is bad, which brings us to the second thing we must do. We must change the default action to Edit, which causes the file to open in Notepad rather than to execute the script.

  • Win 2000, ME

    1. Click Start/Programs/Accessories/Windows Explorer.
    2. Click on the Tools Menu at the top of the page and select Folder Options.
    3. Select the File Types tab and scroll to VBScript Script File and click on it once.
    4. Click the Advanced button.
    5. Another window will open showing the possible file actions, with no default action indicated. Click on the word Edit.
    6. Click on the Set Default button. Edit should now appear in bold face.
    7. Click OK.
  • Win 98, 98SE

    1. 1.Click Start/Programs/Windows Explorer.
    2. 2.Click on the View Menu at the top of the page and select Folder Options.
    3. 3.Select the File Types tab and scroll to VBScript Script File.
    4. 4.Click the Edit button
    5. 5.Another window will open showing the possible file actions, with the default action indicated in bold-face type. The default action is likely Open.
    6. 6.Highlight instead the word Edit and click on the Set Default button. Edit should now appear in bold face.
    7. 7.Click OK.

In some older systems the Edit function may not appear. In such instances, click the New button and enter Edit in the action field and Notepad.exe in the application field. Once Edit appears, make it the default action as shown above.

If you follow these steps and don’t see the VBScript Script File, this means that your Visual Basic Script Program is not installed from your operating system disk. This will only happen in Windows 98. Beyond all of this, there is no substitute for a good Anti Virus program.

I explained earlier how you get worms and what they do, and we covered some virus and worm prevention in the last section. So what happens if, despite all of your best intentions, you still get infected with a worm? Well you can stop them from sending themselves out to everyone in your address book, which is what worms do. To avoid sending Worms, set your email to send in Plain Text Only. To set the email format to Plain Text Only in Outlook Express:

  1. Click on Tools/Options/Send. At the bottom of that window, you will see Mail Sending Format and News Sending Format.
  2. Set both to Plain Text.
  3. Click Apply.

To set the email format to Plain Text Only in Outlook:

  1. Click on Tools/Options/Mail Format.
  2. Set to Plain Text.
  3. Click Apply.

Now there is no way to send the Worm out of your computer because the HTML it needs to propagate, is now disabled.

I don’t know of any way of protecting against Trojans other than a good Firewall, a good Anti Virus program, and good old-fashioned common sense. (Do you see a pattern here?) Use the same diligence to protect against these that you would for Viruses inside attachments.

The next step to take to avoid malicious programming is to have a good anti-virus program. I am a staunch supporter of Norton Anti-Virus, for reasons too lengthy and numerous to cover here. Remember though, an Anti-Virus program is virtually useless unless you update it frequently. I have seen numerous computers “protected” by an Anti-Virus program and the user can’t understand why they got a virus. I ask them when they last updated their program and they usually answer, “Update? What do you mean?” Fortunately, most Anti-Virus software provides these updates free. I recommend updating at least once per week. Given that there are an average of three new viruses released every DAY, staying updated is extremely important. In the case of Norton Anti-Virus, as soon as a new update is available, you are informed of it.

In the unlikely event that you ever get a virus, have no fear. You can contact me through the instructions at the end of this blather and I can remove the virus from your computer over the telephone. Yes it costs money, but there is no waiting and I guarantee my work. Do NOT get mislead by so called “virus removal experts” who do little more than run little programs on your computer that they have taken from the Anti-Virus websites. These DO NOT remove viruses. They merely stop them from continuing the damage they were intended to do. Proper virus removal must be done line by line to ensure it is truly removed.

Now that we have secured our computers against malicious programming, let us take a look at some trouble that an Anti-Virus program won’t protect you from, and that is access to your computers from an unauthorized user. Otherwise known as hacking.

Computer hackers break into systems for various reasons. These can range from showing off, to causing damage, and even stealing CPU time. What would they do with stolen CPU time? The industry standard at this time for encryption is 128 bits. This is the minimum that a website must prove before it is allowed to accept credit cards. In theory, it would take the fastest computer in the world approximately 40 years to crack something encrypted with 128 bit. That is one computer. Imagine if I could feed portions of that same code into 1000 computers and have them simultaneously working on cracking the code.

Having your computer protected by a password is not nearly secure enough, although it is a necessity. Passwords only keep the honest people out. Once a hacker is inside your system, if he is met with a prompt for a password, he will use “Brute Force” programs that methodically enter all combinations of letters, numbers and characters until they stumbles on the right one. Although the program I have can do upwards of 30,000 combinations per second, longer passwords obviously still take a long time to crack. For a 6-letter password that is lowercase and only letters, this equals 308,915,776 possible combinations, taking approximately 3 hours to crack. For an 8-letter password that is lowercase and only letters, this equals 208,827,064,576 possible combinations, taking approximately 1933 hours, or 80.5 days to crack. See what a difference two characters make? Now imagine adding other variables such as uppercase letters, numbers, and characters into the fray, and it isn’t hard to see how to set up a password. A minimum 8-character password with a combination of uppercase and lowercase letters, as well as numbers becomes a formidable defence. Do this with both username and password, and the difficulty doubles. The important thing to remember is that you don’t want a password that is simply a word that you can remember. Imagine the word JUSTIFICATION as our password. It is 13 characters long, so you would think it would be secure. Most brute force programs first run dictionary lists before they start with random character scans. In other words, they run every word in the dictionary against your computer password. Webster’s has approximately 300,000 words in it, of which JUSTIFICATION is one. At 30,000 combinations per second, it would take less than 10 seconds to break that password. Here are my recommendations for selecting a password:

  • Your password should be at least eight characters.
  • Your password should contain a combination of upper and lowercase letters as well as numbers and punctuation symbols.
  • Your password should NOT contain any part of your username.
  • You should change your password every 30 days.
  • When you create a new password, it should not contain any part of the previous password.
  • Your password should not contain a common word or name.
  • You should select a password whose characters you can easily remember.

When a hacker breaks into a system, the hacker normally does not have an unlimited amount of time to peruse the system’s files. Depending on the system type, the hacker will start his or her search in specific locations. For example, within a Windows-based environment, the hacker will quite likely start searching within the MY DOCUMENTS folder. By simply moving your files from this folder, you will make it more difficult for a hacker to locate the information he or she desires. As it turns out, many Viruses also hunt for files that reside in specific folders (again, the MY DOCUMENTS folder is a primary target). By moving files or by renaming such folders, you may also reduce your system’s risk of a Virus attack.

So how do we protect ourselves from this? The program you want is called a firewall. It is software that installs on your computer and blocks access to unauthorized persons. There are a number of different firewalls on the market geared toward personal computer consumption. My recommendation is Zone Alarm, available at www.zonelabs.com. Believe it or not, it is a free download for personal use, and very reasonably priced for business use. This program, when properly configured, will not only stop external access, but it will make you invisible to outsiders scanning a range of addresses that your computer would fall under. With small offices running networks of more than 3 computers that are all hooked to the Internet, I would highly recommend getting a Router. Space prohibits me from getting into detail, but if you talk to a trusted computer technician, they can explain it very well.

If you would like to test your computer and see how vulnerable you are to outside attack, go to www.grc.com, and run the Shields Up! test, as well as the Leak test. As if the above examples of computer risks weren’t enough, here are some more to tempt your cyber tastebuds.

  • War Dialers – Anyone who has a telephone line connected to their computer is at risk of this. Hackers use a program that continuously dials numbers in sequence. When the number is answered, the program determines whether the answering number is a voice line, fax line, or computer line. If it determines that the answering line is a computer line, it logs it for the user’s future reference. Very popular for vendetta-type attacks.
  • Vulnerability Scanners – A program that scans a system for all open ports and logs the vulnerabilities for the user’s later reference. Seen more often for the placing of Trojans or access to a computer as a launch point for something else.
  • Computer Microphones – If a hacker gains access to your computer, he can use your microphone to listen to everything in the room your computer is situated. Very popular for corporate espionage.
  • Ping of Death – Sending a large amount of information to your computer in a Ping that causes your computer to crash.
  • Packet Storm – Sending many packets continuously to a computer to completely tie up its resources and lock it up or crash it.

Not worried yet? Here are a few others. IP Fragmentation, SYNflood, Connection, Kill Session, DNS Spoofing, Insertion and Replay, Delay, Degradation, Simple Direct, Simple Indirect, Progressive, Distributed, Attack by Combination, Fragmented, Deception, Tunneling, Immobilization, Timing, Attack on Prep, Second Intent, Counter Time, and Broken Rhythm.

A good firewall will stop most of this, and even in the event of a war dialer connection, Zone Alarm will make sure that no information can be taken out of the computer.

How Do YOU Look From the Internet?

Many people, not knowing any different, enter their real name and company name into the computer's run-once-only program at startup when they buy a new computer. Believe it or not, this is visible to anyone on the Internet if they know how to reveal it. If you visit my website, I can see that information. As a matter of fact, when using a cable modem for high speed Internet, it can be seen in a simple IP trace! Not sure what your computer’s name is? On your desktop, right click on the My Computer icon and select Properties. When the box opens, you will see what your computer name is under the “Registered To” section. Here is how you change your computer's name to something less identifiable.

*******Be VERY careful and follow these instructions TO THE LETTER! You can cause serious damage to your computer if you click in the wrong place so read twice, click once!*******

Click Start, then Run. Type in "regedit" without the quotes and click ok. Now you are into the central nervous system of your computer. ONE WRONG CLICK AND YOU CAN PARALYZE IT!

(BEWARE THAT THERE MAY BE FOLDERS THAT LOOK VERY CLOSE IN NAME TO THE FOLDERS I REFER TO. READ CAREFULLY AND BE SURE TO ONLY REFERENCE THE FOLDER I LIST EXACTLY!!!!)

  1. Click on the plus sign beside HKEY_LOCAL_MACHINE. A new list will drop down.
  2. Scroll down the new list and click on the plus sign beside SOFTWARE. A new list will drop down.
  3. Scroll down the new list and click on the plus sign beside MICROSOFT. A new list will drop down.
  4. Scroll down the new list and click on the plus sign beside WINDOWS. (WINDOWSNT for NT and 2000 Pro users). A new list will drop down.
  5. Scroll down the new list and click on THE FOLDER ITSELF named CURRENT VERSION.

You will see all of the contents of this folder on the right hand side of the screen. This is all identifying info about your computer in various capacities. Scroll down the list on the right side until you come to the Name REGISTERED ORGANIZATION and/or REGISTERED OWNER. The procedure for changing both is the same so I will only explain it for changing registered owner name. Then you can repeat for changing registered organization if you wish.

  1. Click TWICE on the words "RegisteredOwner".
  2. A box will open up called "Edit String"
  3. As you can see, in the Value Data box, your name is listed.
  4. Select the data in there, i.e. "your name" and delete it.
  5. Type in a new name for your computer. This can be anything you want. I use Default for both.
  6. Click "OK".

CLOSE THE REGISTRY EDITOR BY CLICKING ON THE x BOX IN THE TOP RIGHT HAND CORNER OF THE WINDOW.

Now the name is changed. To see the name change reflected, right click on the My Computer icon on your desktop. Select Properties. Make sure you are looking at the "General" tab, and there it is.

OOPS! I Did it Again!

You have suffered a system crash in the middle of typing that long report and you hadn’t saved it. Now you have to start typing all over again. You clicked the wrong button and accidentally deleted a file or photos. Your computer just won’t start and keeps saying your hard drive can’t be found. Any of this sound familiar? In many cases, the people that suffer these tragedies don’t realize that nothing on a computer is ever truly lost. What you need is a data recovery specialist. Data Recovery is the fine art of recovering lost information on a computer. This includes deleted files, crashed hard drives, and virtually all information you may have thought was gone forever. This can also be done even if your hard drive has been reformatted! Rest assured it is not very cheap, but explore the alternatives. We recently recovered an entire hard drive that had been reformatted on advice from a tech support person. The customer didn’t realize that a reformat meant that all her data would be lost. When the reformat was complete, she realized that 3 years worth of work was gone. We were able to recover EVERYTHING.

Let us take this one step further. Beyond data recovery, there exists a world called Forensic Data Recovery. This would be the extraction of files and information from a computer that a criminal may have been using. It includes data that may have been stolen by a disgruntled employee. It includes finding hidden or deleted files, including emails, that may prove a less than scrupulous employee. Forensic data recovery involves recovering data from a computer (essentially) without turning it on. When a computer is turned on, it changes various settings. The change in these settings is enough to render the evidence on the computer unusable. Some of the things we have seen include hiding information on hidden clusters, embedding information invisibly in a document, renaming extensions to bury the document, etc. We have also seen an instance where a hacker illegally accessed someone’s computer and was storing child pornography on it. By doing this, the hacker never had to worry about getting caught. His computer was always clean. The unsuspecting victim was arrested and charged with possession of child pornography. He lost his wife, kids, house, job, everything. His defence attorney hired us and we were able to forensically analyze the hard drive and show that the images had been placed there remotely and accessed numerous times when the victim couldn’t have possibly been near his computer.

Beware the less than honest, so-called “data recovery experts” that promise the world and deliver nothing. Forensic data recovery is expensive. So are the tools. Proper forensic data recovery programs (there really are only two major players) cost in excess of 2-3000.00 dollars. If a company won’t tell you what program they are using, hang up the telephone. This should not be a secret. It is a critical time when you are calling for this and you don’t need head games.

It is my sincere hope that these instructions were presented in a common sense, easy to understand manner. I hope that you can see that computer security is not the magical, mystical beast that many would have you believe. Computer Security can be exercised by anyone just following a few simple steps once per week. Should you ever have any questions, you can contact me by email at kr1@asginvestigations.com. Should you need immediate virus removal assistance or wish to discuss data recovery with us, feel free to call our offices toll free at (888) 677-9700 from anywhere in North America, or (403) 861-4846 from elsewhere on the planet.

It is time to take over your computer and stop letting it, and malicious programming, rule you!

This is a cookie-free website. No record of your visit will be left in your computer by us.

Advanced Surveillance Group is a full service licensed private detective agency. Our National Headquarters is located in Mt. Clemens, Michigan. We have assisted thousand of clients from the following locations including:

Arizona: Phoenix | Arkansas | California: Los Angeles, San Diego, San Francisco, San Jose, Hollywood| Colorado | Connecticut | Delaware | Washington DC | Florida: Daytona Beach, Jacksonville, Miami, Orlando, Tampa | Georgia | Idaho | Illinois: Chicago | Indiana: Indianapolis | Iowa | Kansas | Kentucky | Louisiana | Maine | Maryland | Massachusetts: Boston | Michigan: Detroit, Troy, Southfield | Minnesota | Missouri | Nebraska | Nevada | New Hampshire | New Jersey | New Mexico | New York: New York City | North Carolina | Ohio | Oklahoma | Oregon | Pennsylvania: Pittsburgh | Rhode Island | South Carolina | Tennessee | Texas: Austin, Dallas, Houston, San Antonio, Fort Worth | Utah | Vermont | Virginia | Washington | Wisconsin

This site is Copyrighted ©2008. Unauthorized use in part or in full is strictly prohibited and violations will be acted upon.
Developed by Pistonbroke