Interesting Situation

UPDATE!!

I'm reposting this now that the situation is officially out of the bag.

The laptop and the iPhone that were stolen have been recovered!!

Details from the San Jose Mercury News:
http://origin.mercurynews.com/opinion/ci_9537933


------------------------------------------------------------------------------------------------
(Original Post)

Here's an interesting situation:

My friends MacBook was stolen out of her truck last week.
I happen to have a dot.mac account as well as a user account
on her laptop.
I can and have been able to pull up the screen when whomever has
the laptop now is using said laptop and connected to the internet.
(i can also access files without sharing the screen via Finder)

Anyone have any suggestions on ways to locate the laptop without
alerting the person that I am on to them?

I've thought of starting photobooth to have a look at who's at the keyboard,
but that would show my hand right away. The other problem is the damn
criminal is too cheap to have their own internet and is leeching a weak wireless
connection, so screen sharing is hit or miss at best.
I have admin access and I have my friends password (i asked her if she wanted
me to delete any files and thankfully she has nothing to dear, besides photos and the like, on the laptop).

Any suggestions for retrieval, or at the very least, making it more difficult for the thief to use the laptop?


edit - update 4-10-08

So i've been watching this guy, he has managed to change the username and password, but i still have admin access via my account on the computer. this guy has no life and apparently no job because he never seems to leave the computer, but at this point he is mostly running limewire. here's some screenshots:





EDIT - UPDATE

I have his IP address:

67.169.177.49



Comcast Cable Communications, Inc. ATT-COMCAST (NET-67-160-0-0-1)
67.160.0.0 - 67.191.255.255
Comcast Cable Communications, IP Services BAYAREA-8 (NET-67-169-128-0-1)
67.169.128.0 - 67.169.191.255



EDIT - UPDATE

Well, after spending much of the day on the phone with various Santa Cruz Police officers, who while very friendly and professional, sort of listened to me as if I was describing some kind of black voodoo magic, I got a call back from a very enthusiastic detective who realized exactly the repercussions of the info that i was relating to them. In essence, once he gets Comcast to release the physical address related to the IP address (how awesome was it to finally get an officer on the line who actually knew what an IP address is!!), he can call me, have me pull up the screen to confirm the laptop is on and in place, and basically they can go in with a warrant and take the laptop back.

That is if everything goes in a best case kind of scenario (and when does that ever happened?). The biggest bummer is every single person I've talked to has repeated that even on a rush job, it could take a week to get an IP warrant. Well, that's some seriously inefficient red-tape. That being said, this jerk-off with the laptop doesn’t appear to be moving around to much as he has pretty much set up the thing to rip dvds (HandBrake) and run LimeWire. In the meantime, I will continue to post screenshots and continue to update here in this thread. I’m still very much open to ideas that anyone cares to offer and thanks to everyone for their support!!

I’ll be cross posting screenshots here:

http://public.fotki.com/joeyrenza/help-find-kims-laptop/


EDIT _ UPDATE 4/11/08



Sometime last night around 10pm EST the laptop went offline and has been offline since.
This could mean several things, it might be as simple as the guy closed the laptop and has been busy doing other things. He may have found an OSX disc and did a clean install, he may have erased my user account, or maybe he got tipped off and realized he was being watched. Hopefully the laptop will pop back up soon, but even if it doesn't we have an IP address which wil hopefully lead to an actual address, and we have a picture of the guy, and Santa Cruz is a very, very small town.


EDIT - UPDATE:

The laptop popped up online briefly this afternoon. Our boy has changed the name of the laptop to DRxFUCKYOU, but thankfully he hasn't deleted my account yet, though he does seem to be getting more savvy, so that could happen soon. I wasn't able to connect to the laptop this afternoon due to shitty internet, but i'll keep an eye this evening and try to get some more screenshots posted.


EDIT - UPDATE 4/12/08

Huge score today!!
For the time being i'm not going to release exact details
because this info i'm finding out is very sensitive and i
want to give the police the best shot they can get at catching
this guy. That being said, today I found out this guy is:
27
an ex-con
i know his DOB
his mom's maiden name (thanks e-bay!!)
(he has been shopping ebay for a police scanner...
i wonder why?)
he belongs to local sex/date hook up site
his email address
and today i snapped a screen shot so clear
that you can read the lettering on his ink

I'm not sure how much more i can do for the SC police
i'm pretty much serving this guy up on a platter...


EDIT - UPDATE - 4/13/08

Well, in a testament to how easy Macs are to use, even this dumbass can firgure out how to delete a user account. So the screen sharing game is up sadly, though i can still connect to the public folders, so that's at least some consolation. Yesterday, despite losing my account on the laptop, was a huge day in terms of finding out info on this guy. I will eventually post the snaps, but I can't stress just how clear of a pic photobooth served up of him.
I'm going to give the SC police a couple days to show some signs of movement on this case, and if there's no development then I'll release all the info I have on this guy and the internets can have it's way with him /chan style. Once again thanks to everyone for their interest, we've had a set-back, but the game is far from up.


EDIT - UPDATE 4-14-08

The warrant / subpoena process has begun...

EDIT - UPDATE 4-23-2008

So Comcast has been served the necessary papers, they should have the address by the end of the week. In the meantime, the police have identified the guy and checked all his known addresses, but alas, he was not present (the police also checked the addresses for the wireless network "GrossNetwork" which is the wi-fi network he is using the laptop on.
Dect. Eveleth received the cdr of screenshots i mailed him (around 100 or so that i took) and he has informed me that he will call as soon as they get the go-ahead to serve the warrant.
So the game is still on!!

------------------------------------------------------------------------

as always, more to follow.

thanks to everyone for their great suggestions!

-Joey