Latent Wireless Information

The traditional method for recovering lost or stolen devices is for law enforcement to be in a position to physically handle the device so they can read the serial number and have it run through the NCIC. If the serial number has been reported stolen then the officer can seize the device and continue their investigation. However, because of 4th Amendment issues, it can be very challenging for officers to get the necessary consent to closely inspect devices. In addition, as a law enforcement officer, you can't just walk through a coffee shop or library and ask everyone to subject their device to inspection without creating many negative encounters. So what can we do to better locate and recover these devices? One solution is to record just one more piece of information: the MAC address of any wireless network controller in the device. Depending on the situation this may be easily identifiable through packaging. Other ways are to examine the DHCP client table of a recently used access point/router, checking with the manufacturer, a system administrator, etc. These MAC addresses can then be entered into the L8NT database. When L8NT is running it is channel hopping through the 2.4 GHz and/or 5 GHz bands and receiving packets. The source and destination MAC addresses are stripped out of the MAC address header of each packet and compared to the known stolen MAC addresses in the database. The remainder of the packet, which includes any "content" data, is ignored and removed from memory to comply with the 4th Amendment. If the MAC address(es) are not in the database they are ignored. If there is a match, the L8NT user is notified. At this point the user can choose to filter all packets except those with a source address of the lost/stolen MAC addresses. By switching to a directional antenna, and using the signal strength meter in L8NT, the user can follow the signal back to the physical device. The methodology utilized by L8NT is patent pending.