Question for Computer Geeks

[Lighthouse 84]

For those computer geeks out there, I'm having a difficult time figuring out the latest story about the Las Vegas shooter.  When replying to this thread, please limit the responses to the question rather than about the shooter, the shooter's motives, the shooter's politics, etc., since that ship already sailed in another thread that's been locked.

The article states the LV gunman reportedly searched for details about techniques used by police, etc. and that the revelation came after investigators found a laptop of the shooter "in his hotel room that was missing its hard drive." 

First, I think the laptop was missing its hard drive, rather than the hotel room, but that's a different issue.

My questions are:

1.  If the hard drive is missing, how are the investigators able to figure out what the gunman was searching for on his laptop;
B.  Since the gunman died in the hotel room, how did the hard drive get out of the laptop; and/or
3.  Why would he take a laptop into the hotel room that had no hard drive? 

I'll hang up and listen for my answer.

[g0lden3agle]

I'm interested in what responses you're going to get to this.  It is my understanding that the operating system lives on the hard drive, so a laptop with no hard drive would have nothing on it that anyone could poke at to figure out what you were doing on it.

Sure, the investigators could have an OS on a thumb drive or something and boot off of that, but as far as I know there would be no record of anything that was done on the computer without access to the hard drive.  RAM doesn't store information after powered down (again, as far as I know).

This is all shaping up to be #fakenews.  They must have had some hard drive/sd card/something that physically stored his info on it for them to say anything about his internet search history.

[🏀]

Wild guess here, but he was in the Mandalay Bay for several days, likely using the computer with the hard drive. Prior to shooting either disposed the hard drive offsite that day or tossed it out the window inbetween firing rounds.

[TinyTimsLittleBrother]

For those computer geeks out there, I'm having a difficult time figuring out the latest story about the Las Vegas shooter.  When replying to this thread, please limit the responses to the question rather than about the shooter, the shooter's motives, the shooter's politics, etc., since that ship already sailed in another thread that's been locked.

The article states the LV gunman reportedly searched for details about techniques used by police, etc. and that the revelation came after investigators found a laptop of the shooter "in his hotel room that was missing its hard drive." 

First, I think the laptop was missing its hard drive, rather than the hotel room, but that's a different issue.

My questions are:

1.  If the hard drive is missing, how are the investigators able to figure out what the gunman was searching for on his laptop;

I think the story was poorly written.  You can find somone's search history in Chrome for instance if you can hack their gmail account. 

[Lighthouse 84]

I'm interested in what responses you're going to get to this.  It is my understanding that the operating system lives on the hard drive, so a laptop with no hard drive would have nothing on it that anyone could poke at to figure out what you were doing on it.

Sure, they could have an OS on a thumb drive or something and boot off of that, but as far as I know there would be no record of anything that was done on the computer without access to the hard drive.  RAM doesn't store information after powered down (again, as far as I know).

This is all shaping up to be #fakenews.  They must have had some hard drive/sd card/something that physically stored his info on it for them to say anything about his internet search history.

That's my thought as well.  the story says nothing about what they've been able to look at to see any of his info.  Maybe it's just a poorly written story?

Wild guess here, but he was in the Mandalay Bay for several days, likely using the computer with the hard drive. Prior to shooting either disposed the hard drive offsite that day or tossed it out the window inbetween firing rounds.

  Makes sense.  Except, why dispose of the hard drive offsite and not the laptop, unless he thought he'd make it out alive and want the laptop still?  And if he tossed it out the window during rounds, it would be recovered, hey?

[T-Bone]

Well in accessing the hotel's wifi, it generally will require a unique identifier to join that network.  (room number + last name or some crap - if not that then the laptop's MAC address could be used when getting an IP address). 
Any searches done would pass through the hotel's proxy server and that data most likely used for targeted marketing purposes.   It's pretty simple to log that information and figure out how to best use it later. 

So not directly from the laptop, but another way around.  Hard drive normally essential for this sort of thing, but not if all his web searches are being logged (which they probably were).

[rocky_warrior]

Any searches done would pass through the hotel's proxy server and that data most likely used for targeted marketing purposes.   It's pretty simple to log that information and figure out how to best use it later. 

This would be my top guess as to how they got the information.

I think the story was poorly written.  You can find somone's search history in Chrome for instance if you can hack their gmail account. 

This is also possible.  And if he had another computer at home logged into his google account, then they wouldn't even have to hack anything. Your chrome history and bookmarks are shared across devices (unless you elect not to share them...).  His cell phone may have revealed this too.

I also don't know if they have been asked during the investigation, but it's possible Google could have coughed up the information too.

[GB Warrior]

Your OS lives on your hard drive, so that part of the story doesn't register. I think there could hypothetically information cached in RAM as well.

Much more likely is what TBone said, which is that ISPs and the hotel can see traffic assuming no VPN. Whether an ISP would cooperate is a different conversation  (similar to the iPhone debate in San Bernardino) 

[muwarrior69]

Maybe he had a flash drive and therefore no hard drive and the investigators are not that tech savy.

[forgetful]

Well in accessing the hotel's wifi, it generally will require a unique identifier to join that network.  (room number + last name or some crap - if not that then the laptop's MAC address could be used when getting an IP address). 
Any searches done would pass through the hotel's proxy server and that data most likely used for targeted marketing purposes.   It's pretty simple to log that information and figure out how to best use it later. 

So not directly from the laptop, but another way around.  Hard drive normally essential for this sort of thing, but not if all his web searches are being logged (which they probably were).

This is what I had thought for number 1.  But, what happened to the hard drive?

If it was thrown out the window, it could still be recovered.  If tossed in the trash, it wouldn't be that hard to track down all the trash from the hotel (especially since I'd hope they noticed the hard drive was missing fairly early).

Why get rid of it?  These types of things make one think there could have been an accomplice.  (Hope this last part doesn't violate your rules of engagement).

[Lighthouse 84]

This is what I had thought for number 1.  But, what happened to the hard drive?

If it was thrown out the window, it could still be recovered.  If tossed in the trash, it wouldn't be that hard to track down all the trash from the hotel (especially since I'd hope they noticed the hard drive was missing fairly early).

Why get rid of it?  These types of things make one think there could have been an accomplice.  (Hope this last part doesn't violate your rules of engagement).

That’s what I’m thinking as well. Why did the gun man take the laptop back to the room without a hat drive in it? My guess is it had the hard drive in it so he could monitor the internet.  Someone took it out. Things aren’t adding up for Mr. Campos.

How’s that for conspiracy theory the night they release JFK info?

[TinyTimsLittleBrother]

Articles have said that he had searched the internet earlier for software that could erase a hard drive.  I don't think it means an accomplice.  More that he wanted to leave investigators with no clues as to his motivations.

[Lighthouse 84]

Then why remove it?  Just changed his mind?

[TinyTimsLittleBrother]

Maybe he didn’t believe the software was enough. I don’t know. I just doubt there was a conspiracy because there is no evidence to suggest there was. I think there is plenty of evidence that he was a loner who was an enigma.

[forgetful]

That’s what I’m thinking as well. Why did the gun man take the laptop back to the room without a hat drive in it? My guess is it had the hard drive in it so he could monitor the internet.  Someone took it out. Things aren’t adding up for Mr. Campos.

How’s that for conspiracy theory the night they release JFK info?

I do love a good conspiracy theory. 

The problem here is that there is so little information, and a lot of timelines that don't match up.  It makes for rich opportunities to postulate what really occurred.

[mu03eng]

Long shot, but he could have also had an external hard drive that he was doing his data collection on and that's what is actually missing. Generally seems like no matter what the article was poorly written.

[ZiggysChestHair]

  Makes sense.  Except, why dispose of the hard drive offsite and not the laptop, unless he thought he'd make it out alive and want the laptop still?  And if he tossed it out the window during rounds, it would be recovered, hey?

A laptop in the trash sticks out.  There is a greater chance of someone noticing it.  However, nobody is going to notice a laptop hard drive.  Makes it much harder to recover.