Skip to main content

Our company recently had a system stolen from us, a system that was (mistakenly) not enrolled in our JSS. Fortunately, it was enrolled in DEP so, once the system was wiped then it checked in with DEP and, subsequently, showed up in our JSS (I love this).



Besides trying to ID the system's precise location (see @bollman 's stunning geolocation script for this), I wanted to be able to capture pictures using the laptop's webcam and, much to my surprise, found that JAMF doesn't have this function (I came from from a Meraki world, where you could do all sorts of great stuff like that to track down stolen systems).



So I cobbled together the following script that, once you push imagesnap to the remote system's /usr/local/bin directory, can take a picture and upload it to a FTP server:



#!/bin/sh



# This script will take a picture using the laptop's default camera device, save it to

# the /tmp directory, upload the image to a FTP server and then delete the picture itself.

#

# Note the the webcam's 'on' light will turn on for 1-3 seconds as the picture is being

# taken.

#

# This script requires the installation of imagesnap to the /usr/local/bin directory.

# http://iharder.sourceforge.net/current/macosx/imagesnap/



/usr/local/bin/imagesnap - > /tmp/$(date +%Y%m%d_%H%M%S).jpg



touch /tmp/creds.txt

chmod 666 /tmp/creds.txt

echo "open <FTPserverIPorName>" >> /tmp/creds.txt

echo "user <FTPloginName> <FTPloginPassword>" >> /tmp/creds.txt

echo "lcd /tmp" >> /tmp/creds.txt

echo "put <yyyy>*.jpg" >> /tmp/creds.txt

echo "bye" >> /tmp/creds.txt



ftp -n < /tmp/creds.txt



rm /tmp/<yyyy>*.jpg

rm /tmp/creds.txt


The webcam's light comes on for 1-2 seconds as the pic is taken (unavoidable) but all you need is a few shots to get what you need. Obviously, fiddle with your policy to get this to fire of when you want (I'm just brute-forcing it with "at every check-in" and will manually kill the policy once I've got a few shots but a smarter person could consider setting up up on a schedule or, perhaps, even embedding a call to the script in the systems crontab).

I think camera interaction has come up a few times before, but there's all sorts of privacy issues with that type of feature.



Handy to know that imagesnap can work with the camera though for use cases like this.

Do keep in mind that the pictures you take may not be of the culprit but rather of an innocent person in his or her own home. Neither of you has control over what you see.



I suggest you provide the location information to the police and let them handle recovery.

Might want to look at Prey Project instead: Prey Project



There are a couple of discussions here about how to deploy:



Prey Project Mass Deploy through



Track Down Stolen Computer - Using Prey



I was able to recover a stolen machine a year after it was stolen using DEP and Prey Project. You can use the free version which limits the number of machines to like 3 or 4, but it works.

@talkingmoose Duly noted - very ware of the fact that, in all likelihood, the user of the system is someone who unwittingly purchased it from the thief. But any corroborating evidence available to help police get on the right track is useful (I know this from prior experience).



@stevewood I've seen Prey mentioned in other similar discussions (many times, in fact) and I fiddled with the free version, which doesn't let me take webcam pictures (at least, not as far as I could figure out). Looks like a cool tool but not worth the $ for this one-time application. Besides, this was a good excuse to try and figure out a solution on my own...

@ChrisJScott unless something has changed, which I doubt, Prey did take webcam shots and screen shots of what was on screen. Both were uploaded to the Prey web site so you could see them. I was able to recover the machine because the guy who had it happened to have Google Maps open and getting directions to some place when Prey snapped the desktop. That and the pic of the guy were enough evidence for the police.



Prey works on a timer of sorts, IIRC, and it does it's thing every so many minutes or something. I don't think there's a command you send it to take the pics.

Sorry but one stolen laptop is no excuse for deploying that, let alone posting it here. obv this could be widely abused very easily. As well as potentially illegal depending where you/laptop are located.

Reply


Terms & ConditionsCookie settings