My husband installed a spyware on my Macbook.

[chikachic]

Hello Tweakers,

I need your help and guidance. So here is my long and sad story.

My husband and I are going through a divorce. In August 15, he wants us to split amicably for the sake of our children. I agree. This all sounds great and logical.

He quit his job in November 15 and had to return his work laptop. I felt sorry for him and allowed him to use my Macbook as a guest user. But I only found out that he added himself as an administrator instead when he got me to type in my password and then turned my Macbook from me so he could chose administrator function instead of the standard function.

I have just appointed a divorce lawyer and was gathering my documents for her and found some of my crucial voice memos, documents and evidence have been deleted from my Macbook.

A few weeks ago, we had a fight where we both recorded it on our phones. There were bruises and a fractured rib. But unbeknown to me, he made a police report against me, saying I was abusing him! He had submitted his heavily edited voice memo of the fight, favouring him, to the police. I couldn't defend myself because I found out my voice memos which was transferred to my Macbook, have been deleted. Social services are now involved.

The latest is that I had my computer checked for spyware 2 days ago, and the computer shop found and removed a keylogger software on my laptop, He has been spying on me for months now, if not years. I have an original black Macbook, which I am sure has the keylogger software installed. On my older Macbook, I found out today at the Apple Store that he has made himself the Administrator and I, as the guest user.

I understand divorce bring out the ugliest of people, but he has led me to believe that this divorce was going to be amicable for the sake of the children when in fact, he was using all the dirty tricks in the book. Quitting his job so he will not have to pay for the alimony. Making a police report against me, and deleting my supporting evidence. Deleting his apology email for hitting me that night amongst others. Adding spyware on my laptops.
I know you will berate me for being so trusting towards him especially when we are divorcing. But being married for 18 years makes that habit of trust hard to change, until today.

My questions are:
1) This has been a breach of my very basic human rights and I need evidence that it was my husband that planted the spyware on my laptops. My newer laptop has the spyware removed. But I have a time machine that may also back up the spyware from previously. I don't know if it cloned the laptop, though. My very first backup made to the time machine would have him as an administrator. Can I get an IP address on where my information was going to?

2) How can I retrieve my deleted data from my newer laptop? I need those voice memos and documents.

3) How do I get myself on an administrator status on my black Macbook?

4) Who can I go to for these assistance? Two names were given to me today: Kroll Ontrack and Fox IT. But do these companies who deal with corporate clients want to deal with a domestic one?

A kind soul from a data recovery company whom I spoke to today, pointed me to this group for help and guidance. And I hope for the best.

I have moved to this country for my husband's job and have no friends or family here. It is incredibly overwhelming right now. I thank you all for reading this far and I gratefully accept any help and suggestions coming this way.

[Mandrake466]

"A kind soul from a data recovery company whom I spoke to today, pointed me to this group for help and guidance"

Why didn't that 'kind soul' recover the data for you?

[Mmore]

Perhaps because it is beyond the capabilities of what the data recovery company she has been in touch with could've done?

As far as recovering access, data and evidence goes: do not touch the equipment. I'm afraid that much of the evidence of tampering that could've been recovered is already gone if an Apple store or data recovery company has been working on it, but perhaps there might still be traces, in particular on the machine to which you’ve only got guest access. It is considered best practise in cases such as these to not work on the device itself, but instead clone the harddrive(s) and run these on different machines with specialised software.

In regards to actually recovering removed content and perhaps even getting proof you’ll have to turn to professionals. Whilst advise could be provided on forums such as these, anything recovered will be much harder to use legally.

When it comes to finding a company to help you, the only thing that matters to them is whether or not you can afford them. The type of expertise that is required to recover data and in particular (actionable) evidence is both expensive and time-consuming. However, if you can afford it, of course they will be able to help you. FOX-IT is considered excellent, I suggest just giving them a call for an assessment. But as I said, you'll pay a premium for these type of services.

Now what you should probably do is disregard everything I’ve said and get legal advice from a lawyer...

[Spekkie88]

Since you have a time machine backup, aren't the deleted files still there?

[oohh]

Spekkie88 schreef op vrijdag 12 februari 2016 @ 10:12:
Since you have a time machine backup, aren't the deleted files still there?

This, depends on when you made your last Time Machine backup though.

Regarding your other questions:
It is not very hard to regain control over your MacBook. The easiest thing for you to do is to fully wipe your MacBook. Everything is then deleted, but you can get your personal files from the Time Machine backup (see above). Please wait with this until the 'investigation' of your laptop has completed, because if you do this beforehand, it is not possible to fully investigate this issue.

If you really want to investigate the matter, you have to take in to account the aftermath. What do you want to do with the evidence of your ex husband putting spyware on your laptop? Of course, it is prohibited to put spyware on someones computer this, but you probably have to prove this in a court of law. This will take a long time and can/will be very demanding. Sometimes it is best to just leave things behind you. Of course, this is a decision that you have to make yourself, but please think about the consequences (for your own well being).

[supersnathan94]

It is not very hard to regain control over your MacBook. The easiest thing for you to do is to fully wipe your MacBook. Everything is then deleted, but you can get your personal files from the Time Machine backup (see above). Please wait with this until the 'investigation' of your laptop has completed, because if you do this beforehand, it is not possible to fully investigate this issue.

No it's not. Pretty easy actually if filevault is not enabled. I use the same method as used to reset a macbook to factory clean (so without admin accounts), but leaving all software and files intact. It is pretty simple for me to do so, but You don't want to do this.

I have some experience in OSX file recovery as well, but this is a painstakingly long project which can take days and is pretty expensive as well. Then you'll be having a read only copy of the complete drive, but some files can still be corrupted. Whatever you do. do not start the mac. the deleted files will then be overwritten.

[Fonsdespons1]

From a legal viewpoint the complaint filed by your husband with the edited data file might be more interesting. The alteration of computer data, resulting in inauthentic data with the intent that it be considered or acted upon for legal purposes as if it were authentic, has to be a criminal offense under national criminal law. This may require an intent to defraud, or similar dishonest intent.

This convention has been signed by the countries of the EU, the US and Japan. I think it should be easy for somebody with some IT knowledge to prove that his 'evidence' has been tampered with. And opposed to the spyware on your Macbook a judge will probably accept the fact that it was your husband who committed the offence. Depending on which country has jurisdiction (art. 12 Directive 2013/40/EU on Cybercrime), article 5 of that directive also applies. The Convention and the Directive basically both state that the alteration of data has to be a criminal offence under national criminal law.

I realise this might not help you with the spyware your husband installed on you computer and the files he deleted but I think this last offence might be more difficult to prove. And I think it might benefit you in the divorce proceedings if you can get your husband convicted for data interference going into divorce proceedings. Also this means your husband has filed a false complaint so you should be entitled for damages for the criminal offence of data interference,and for the false complaint.

I wouldn't touch the Macbook. Discuss with your lawyer how it can be used as evidence. Depending on your hausband's IT skills the evidence of his involvement might be right there, spyware has to send data somewhere, if you're lucky he sent it to a computer or account that's linked to him. If not his computer or server, even if it's situated in another country can be seized by the authorities.

The author of this post submits this information strictly for informative purposes and no liability can result from its use.

[ Voor 14% gewijzigd door Fonsdespons1 op 12-02-2016 12:23 . Reden: Disclaimer ]

[vso]

*kuch* nederlands ? ik weet dat menig topic is gesloten ..

Chikachic shoud youse google translate .. to translate this topic from dutch to english (topic might be closed ..otherwise)

Goto an aple store let them help you deny access to your ex. .

Divorce is ugly and yes you should get advise however we are not the appointed source of divorce advise you should find a laywer who can assist you.

[ Voor 14% gewijzigd door vso op 12-02-2016 12:09 ]

[Postius]

*snip* troll

[ Voor 101% gewijzigd door Daedalus op 12-02-2016 13:50 ]

[Pietervs]

*snip* voor de volgende keer kun je beter een topicreport aanmaken

[ Voor 86% gewijzigd door Daedalus op 12-02-2016 13:50 ]

[Daedalus]

Modbreak:

Gathering of Tweakers (despite the name) is a Dutch community. We expect people to read and write in Dutch. In this case, however, it's ok for chikachic to respond in English and other users can respond in Dutch or English.

[chikachic]

Dear all that have replied to my post so far,

Thank you for taking your time in replying to my plight. I am grateful for your responses. I am currently reading them through and digesting the information you have shared here.

Mandrake466: The kind soul at the recovery data company couldn't help any further as the deleted data was from November last year and probably a few weeks back. As mentioned by Mmore, it was beyond his capabilities.

Mmore: You have raised a few interesting points. I will get in touch with the data recovery company, probably the kind soul again to clone the older Macbook and take it from there. In the meantime, I will physically hide this laptop before my husband tries to erase his actions. He must have figured out that the spyware has been removed from my newer laptop. It is also reassuring to know that Fox-IT comes recommended but with a premium. Still this is an option to explore.

Spekkie88: The deleted files back in Nov 15 were not backed up. I only bought the time machine in January 16. My husband since putting himself as an administrator on my laptop in Nov, has been systematically and stealthily deleting my documents.

Oohh: I do think about the aftermath. But currently, I am firefighting. My husband is working very hard to disregard my role as a wife (I am a husband beater) and a mother. Right now, I need to also get my head around the technicalities of my laptops. Your points are very valid.

supersnathan94: Oh dear, I have done exactly the opposite of what you have advised. I wasn't even aware that the files were deleted. That was why I continued using the laptop as normal. Documents recovered as read-only as you have mentioned, but what about voice memos? I have critical information and evidence on these deleted voice memos.

Fonsdespons1: Thank you for your response. This is an interesting angle that I will investigate further with my lawyer. In fact, instead of hiding my older laptop, as stated above, I will pass it on to her for safe keeping until I can get practical and reliable help. I understand I need to seek legal advice but your legal pointers are extremely helpful.

vso: I have a lawyer, but she needs more concrete evidence on data tampering and unauthorised data deletion. The guys at the Genius Bar are too time-constraint. I have approached a few of them if they would be interested in freelance work but to no avail. This was how desperate I was until I found this forum.

I am well aware that I am bordering around the legality issues along with the technical issues. This is unfortunately the nature of divorce, it is in shades of grey, never black and white. And most things overlap.

On the technicality side of things:
Can I assume that my husband is unable to delete the spyware he installed onto my older laptop, remotely? I just don't know how sophisticated things can be.

When the guy at the Genuis Bar first backed up my hardrive onto my time machine, my husband was still an unauthorised administrator. Is there any way to see what footprints he has left behind from the first back up?

Finally, who is the go-to-person to work on my laptops. Fox-IT was suggested, but is there a small establishment that is just as good?

Daedalus: Thank you for allowing this discussion to be conducted in English. This forum is my last resort to reach out.

I thank you all once again for your considered responses. It is giving me hope. Please if you have any further thoughts, I am grateful to hear them all.

[supersnathan94]

Everything that can be retreived will be copied and set to read only. This will be for everything and it will be locked with a drive password of your choice or a strong one I can generate for you.

I can imagine that the laptop has been used due to not knowing that files were actually deleted. This might be a problem, but we can give it a try at least. You can contact me through a direct message from my profile (just click my name and then the blue-ish bar you'll see there) to discuss this as this might be the only possible way of getting back the data without tampering with the drive itself. I should be able to copy all data without editting permissions. So this should be a legal way to get the data back and not tampering with it more then already has been done.

Edit:

We may also take out the drive and refit a new one. Then perform a clean install and put back the time machine copy and make a read only copy of that as well.

[ Voor 9% gewijzigd door supersnathan94 op 12-02-2016 15:48 ]

[liberque]

First of all how can you be so sure that the keylogger that was detected was installed by your ex? If you want to use this as evidence you actually need to prove that he was the one that planted it on your laptop in the first place. Him having access to your laptop is circumstancial since keyloggers can be installed by using online trojans etc. - you will need physical evidence.

The computershop detected the keylogger to begin with and deleted it - but did they also tell you which keylogger was installed? This is very important because you want to know how the suspect was able to read the logs. Most freeware keyloggers (the ones you can get free from the internet) are crippled and don't send out the logs to another computer. Some do for a short amount of time (7 days) but it the end without paying for a full-version of the keylogging software the access to the logs would be restricted to the person having physical access to the laptop. (eg. there would be no IP addresses to track down).

Also take in acount that malicious software could also incorporate a keylogger which is mainly there to get your creditcard and other personal info. In that case your ex would prolly have nothing to do with the keylogger at all - and the malicious software could've been downloaded from the internet.

He just logged into the laptop you gave him access 2 and deleted files: which might not be nice... but isn't criminal since you gave him access and didn't monitor him. It's like giving someone your wallet and whining afterwards that your missing 10 euro: not a single judge in the world will put the person you gave ur wallet 2 in jail.

So all in all you are drawing the short straw here about the keylogging software and him deleting files - since you can't prove a thing. The best thing you can hope for is to recover the files, but since you've been using the laptop after the deletion I wouldn't hold your breath.

So what CAN you do? Get divorced - focus on your children and stop spending your time in your ex. Think of him as a small child trying to get the better off you (i reckon he has some issues with the divorce to begin with). The best thing you can do is simply ignore it! You had a domestic fight with him and he filed a police report against you: those things won't hold up in court either. He blames you, you blame him, he gives forged prove, you say its forged and he deleted your evidence... his word against yours... your word against his... no 3rd party involved... so ignored by every single judge out there. As long as your not married on prenuptial agreements it's 50/50.. buy him out or sell the house and start over.. your the mum so don't worry about who gets the kids assigned... 95% of the times the mother wins.

Good luck getting your life back together.

[chikachic]

Hello Liberque,
Thanks for your reply. I appreciate the reality check from you.
The question you asked regarding what type of keylogger is an important question. I looked into the virus scan log provided by the computer shop, and it states as below:

2016-02-10 12:13:41 :
2016-02-10 12:13:41 : ----- Scan Started -----
2016-02-10 12:13:41 : Scanning with signatures version 50 (2016-2-6)
2016-02-10 12:13:42 : PUP.Elite Keylogger : /Library/ScriptingAdditions/FScript64.osax
2016-02-10 12:13:43 : *** scan time: 0d 00:00:01 ***
2016-02-10 12:13:43 : ------ Scan Ended ------
2016-02-10 12:14:20 : ---- File Removal Started ----
2016-02-10 12:14:20 : ===========================================
2016-02-10 12:14:20 : REMOVING ITEM: PUP.Elite Keylogger
2016-02-10 12:14:20 : >> Removing file item: /Library/ScriptingAdditions/FScript64.osax
2016-02-10 12:14:20 : ---- File Removal Complete ----

I didn't realise there are various types of keylogger.

Just briefly, can someone confirm if this particular keylogger can be embedded into my laptop by a malicious virus or is this planted in by someone with malicious intentions?

Thank you all.

[macnerd]

Regarding the voice records that your (soon to be) ex gave to the police as evidence of the fight: tampering with voice recordings is often be seen if the sound is inspected. The tools get better all the time, but if your ex is not a professional in this area then it can probably be seen by the expert. Since you're the accused one, you have a right to have the evidence examined. It is probably best to discuss with your lawyer how to handle that. Please note that the outcome may be that the recordings are genuine, if your ex did a 'good' job.

Your lawyer probably already told you, but there is alimony for the partner and for the kids. The alimony for the partner lasts 12 years in this case (because of the children). The alimony for the kids is (I believe) until they become 18 years of age. The obligation for the partner alimony stops when the receiving partner has a joint household with a new partner.

What you could do is something similar: consider working less hours. Work enough to pay your bills for yourself and your children, but do not work for his bills. He may or may not have unemployment or social benefits, since he quit his job himself. Also, if the children will be living with you, he has to pay alimony for the children (you're already paying extra money by feeding them et cetera). If he starts working again, you can request a re-evaluation for the height of the alimony.

One other thing to think of (assuming that you are married without prenuptial agreements): half of everything that you both own is yours (money in saving accounts, car(s), house, tv). Very personal things like clothing and perfume stay personal. I would suggest that you record specifically what those belongings are, and perhaps transfer part of the money into personal bankaccounts for you both. In that case both of you have money you can access for personal use, while there is less for the other 'to take'. Also consider to remove the possibility to go negative on your shared bankaccounts, you don't want to pay any debt that he makes.

Good luck anyway.

[Kuusj]

Regarding the keylogger software, this is what I found with a quick Google search: http://www.elite-keylogger.net/elite-keylogger-mac.html

It seems as if this software can be downloaded by anyone and has to be installed on the device that the downloader wants to spy. The website has a note whether these loggers are legal or not, I quote:
"Are keyloggers legal? Yes, hidden keyloggers are legal, as long as you own the computer you are installing it on, or have been given administrative privileges to the computer by the owner. Elite Keylogger installation requires that you know the Mac's administrative password."

You said you didn't notice he was using your password to make himself a administrator, but he did get it from you so it unfortunately does check one of the boxes needed to make this "legal". However, he does not own the laptop, so according to the website of the software it would be illegal anyway, regardless of the fact that he "had been given administrative privileges". Anyway, judging by your story, I wouldn't spend any time in your soon too be ex-husband, he is simply not worth it. You could try to gather evidence that he could be the only one that had installed that software (and you would need to prove that you didn't do it yourself..), but again, I don't think it is worth your time at all.

[Anoniem: 172410]

You say you recorded a fight on your phone, right? This might be another way of recovering those files. Be sure not to sure any data carrier that might contain or has contained useful evidence.

kuusj98 schreef op zaterdag 13 februari 2016 @ 00:03:
You said you didn't notice he was using your password to make himself a administrator, but he did get it from you so it unfortunately does check one of the boxes needed to make this "legal". However, he does not own the laptop, so according to the website of the software it would be illegal anyway, regardless of the fact that he "had been given administrative privileges". Anyway, judging by your story, I wouldn't spend any time in your soon too be ex-husband, he is simply not worth it. You could try to gather evidence that he could be the only one that had installed that software (and you would need to prove that you didn't do it yourself..), but again, I don't think it is worth your time at all.

Be careful with statements like these. Proving he planted the keylogger and/or deleted certain files might very well impact legal rulings down the line regarding alimony, custody and more. Especially if the other party is trying to stage evidence.

[Kuusj]

Anoniem: 172410 schreef op zaterdag 13 februari 2016 @ 00:18:
You say you recorded a fight on your phone, right? This might be another way of recovering those files. Be sure not to sure any data carrier that might contain or has contained useful evidence.


[...]

Be careful with statements like these. Proving he planted the keylogger and/or deleted certain files might very well impact legal rules down the line regarding alimony, custody and more.

As I'm not too aware and knowledgeable of legal rules, could you explain why? I don't think (or know how) doing either nothing or trying to gather evidence can influence a legal proces in her disadvantage. Anyway, if my "advice" could hurt anything please ignore it, but the information about the type of keylogger and how it has to be installed still stands.

[Anoniem: 172410]

kuusj98 schreef op zaterdag 13 februari 2016 @ 00:24:
As I'm not too aware and knowledgeable of legal rules, could you explain why? I don't think (or know how) doing either nothing or trying to gather evidence can influence a legal proces in her disadvantage. Anyway, if my "advice" could hurt anything please ignore it, but the information about the type of keylogger and how it has to be installed still stands.

If the other party (the husband) produces evidence that has or has not been edited, or you rely on evidence that you are unable to show, you need a proper explanation of why things seem to be what they are. If the husband really fabricated evidence, you need to make sure it does not pay off. Not having evidence puts you at an disadvantage, saying the husband erased it without any proof might hurt your case even more. Even if you cannot definitively prove the story, you can at least show that it lines up with the facts and evidence.

Being credible is important, especially if failing could mean a significant financial loss or losing custody.

[liberque]

If the other party (the husband) produces evidence that has or has not been edited, or you rely on evidence that you are unable to show, you need a proper explanation of why things seem to be what they are. If the husband really fabricated evidence, you need to make sure it does not pay off. Not having evidence puts you at an disadvantage, saying the husband erased it without any proof might hurt your case even more. Even if you cannot definitively prove the story, you can at least show that it lines up with the facts and evidence.

This can work both ways: the judge believes you are credible or he/she does not. If the other party provides believable evidence, false or not, it will be a hard case for you to prove it's not - even with a good story. If you're lucky though; his evidence is easily to be marked as a fraud and you will hardly have to prove anything... but are you sure you want to depend on luck?

The best way to fight false evidence is not to acknowledge it as evidence at all. By fighting it you actually ratify it - and you don't want to do that.

Tell the judge that you discard the evidence provided - in protection of your ex due to an extended investigation could lead to his incriminisation and that this will be traumatising for the children". This tells the judge two important things: 1. there is something fishy about this evidence - so we should examine the evidence carefully 2. she's not 'busy' with the childish fight between two ex-partners but concerned for her children - even when receiving these accusations and even when this works in favour of her ex.

Mind you the judge can still ask for a reconvention about the accusations your ex made, but in that case it will be on his/her request (legally you will be defending at that moment instead of counterattacking. You will then be able to use your story and accompany it with a small testimony of the computershop to ratify it. This way a judge is much more easily suaded to your side without the risk of making you the agressor.

[Anoniem: 172410]

liberque schreef op zaterdag 13 februari 2016 @ 01:47:
The best way to fight false evidence is not to acknowledge it as evidence at all. By fighting it you actually ratify it - and you don't want to do that.

How exactly do you imagine that? If the husband turns up with a story of abuse and false evidence (assuming this all is true), and you just go meh, don't care. That would be taking quite a gamble.

Tell the judge that you discard the evidence provided - in protection of your ex due to an extended investigation could lead to his incriminisation and that this will be traumatising for the children". This tells the judge two important things: 1. there is something fishy about this evidence - so we should examine the evidence carefully 2. she's not 'busy' with the childish fight between two ex-partners but concerned for her children - even when receiving these accusations and even when this works in favour of her ex.

There is only one proper way of dealing with this and that is asking an experienced divorce lawyer for help. Meanwhile, with evidence your position is always better than without or with a half-baked story you cannot back up. Whether you use it in court is to be decided, together with your legal representative. Gather evidence, build a dossier, discuss a strategy and take it from there. Certainly do not trust the legal advice random internet strangers give you

Prepare for the worst, hope (and strive) for the best. When dealing with the future of your kids and possibly your own monetary future, gambling is not a great option.

[ Voor 11% gewijzigd door Anoniem: 172410 op 13-02-2016 05:58 ]

[supersnathan94]

kuusj98 schreef op zaterdag 13 februari 2016 @ 00:03:
Regarding the keylogger software, this is what I found with a quick Google search: http://www.elite-keylogger.net/elite-keylogger-mac.html

It seems as if this software can be downloaded by anyone and has to be installed on the device that the downloader wants to spy. The website has a note whether these loggers are legal or not, I quote:
"Are keyloggers legal? Yes, hidden keyloggers are legal, as long as you own the computer you are installing it on, or have been given administrative privileges to the computer by the owner. Elite Keylogger installation requires that you know the Mac's administrative password."

You said you didn't notice he was using your password to make himself a administrator, but he did get it from you so it unfortunately does check one of the boxes needed to make this "legal". However, he does not own the laptop, so according to the website of the software it would be illegal anyway, regardless of the fact that he "had been given administrative privileges". Anyway, judging by your story, I wouldn't spend any time in your soon too be ex-husband, he is simply not worth it. You could try to gather evidence that he could be the only one that had installed that software (and you would need to prove that you didn't do it yourself..), but again, I don't think it is worth your time at all.

Well this might be the case in the US, But in the Netherlands using the admin password without consent (by just stealing it for instance) is not considered legal at all. Your whole post does not make sense. it seems logical but it isn't

[Anoniem: 736189]

supersnathan94 schreef op zaterdag 13 februari 2016 @ 11:08:
[...]


Well this might be the case in the US, But in the Netherlands using the admin password without consent (by just stealing it for instance) is not considered legal at all. Your whole post does not make sense. it seems logical but it isn't

sound like husband en wife share de two computers with consent. so use of keylogger is legal...

[Anoniem: 172410]

Anoniem: 736189 schreef op zaterdag 13 februari 2016 @ 22:42:
sound like husband en wife share de two computers with consent. so use of keylogger is legal...

Not true. If I allow someone the use of certain hardware, I do not automatically consent to being tracked or the hardware being altered. If I give my neighbour my house key, I do not automatically consent to the neighbour living in my house, moving my furniture or taking my jewellery.