Investigation Reports

First Contact Received

Set automatically when the device contacts our Monitoring Center for the first time after the theft. Information received from this and any subsequent connections is being reviewed for evidence. At this time, there is not sufficient evidence to pursue investigation with law enforcement. You will be notified when this status changes.

Researching

Information is being received from your stolen device on a regular basis and analyzed by our Theft Recovery team. Once sufficient evidence is collected, it will be provided to the investigating police officer.

Recovery of the stolen device depends on how often it connects to the Internet, capacity of local law enforcement, speed of court approvals for search warrants and subpoenas, and other factors.

Your recovery status may change to Monitoring when progress is delayed by reasons such as those listed above.

When additional progress is made, your status will return to Under Investigation. You will be notified if your device is recovered.

Information disclosure regarding your device and the ongoing criminal investigation may be restricted due to legal requirements.

Device Connecting Internally

Your device is connecting to the Internet from within your home or organization's network. We have contacted you and asked you to locate the device, and are awaiting your reply. If you have already responded and this status is still displayed, please disregard as your information will be processed shortly.

Require Information

We have contacted you and asked you for additional information, and are awaiting your reply. If you have already responded and this status is still displayed, please disregard as your information will be processed shortly.

Awaiting 1st Post Theft Contact

Your stolen device has not yet contacted our Monitoring Center. To contact our Monitoring Center, it must first connect to the Internet. On average, most devices will contact our Monitoring Center within approximately 45 days of theft. However, some will take longer. We will continue to monitor your device. Once it contacts our Monitoring Center, we will begin compiling evidence to provide to law enforcement to assist with the recovery. You will be notified when this occurs.

Following are a few examples of why a device might not contact our Monitoring Center immediately after the theft occurs:

1. The device is idle in a pawn shop until it is sold.
2. The power cord was not stolen with the device, delaying usage until an alternate power cord can be found.
3. The thief turns on the device only to ensure that it works, but does not connect it to the Internet.

There are instances where the device will never connect. For example:

1. It was destroyed or dismantled for parts.
2. The device was used without ever connecting it to the Internet.
3. The hard drive was swapped or reformatted. On many modern machines from large OEM manufacturers, our software is embedded in the BIOS and will reinstall itself after the hard drive is swapped or reformatted. However, if the agent software is NOT embedded in the BIOS, the agent software may not survive reformatting of the hard drive and the device will be unable to contact the Monitoring Center.

Awaiting Device Movement

Your device was reported stolen in one country but is now connecting to our Monitoring Center from a different country where cross-jurisdictional law enforcement cooperation is not feasible. Your investigation report remains open and is monitored for changes. If the device is moved to a country where we are able to engage law enforcement to facilitate a recovery, investigation will resume and your status will change to Under Investigation.

Awaiting Further Device Contact

Your device has stopped contacting our Monitoring Center for an extended period of time. Your investigation 
report remains open and is monitored for changes. We are automatically notified if the device contacts our Monitoring Center again.

Pending New Leads

Information received from your stolen device has been minimal and insufficient to pursue recovery. The file will continue to be monitored for information that can be acted upon.

Police Unable to Pursue

Our efforts to initiate an investigation with law enforcement have met with restrictions in the pursuit of the recovery. This status is only used if it appears that there will be a lengthy delay in law enforcement efforts. Your investigation report remains open and the situation is reviewed regularly. When law enforcement can be re-engaged, the status may be set back to Under Investigation, depending upon the frequency of device connections and the quality of data retrieved.

Retrieved-Not Stolen

Investigation Report has been closed because the device was not actually stolen and has been located with the assistance of our team.

Recovered

Investigation Report has been closed because the device has been recovered and our software and services contributed to the device's recovery. The device is now (or will soon be) in your possession.

Jurisdictional Restrictions

Investigation report has been closed because your device was reported stolen in one country but was moved to a different country where cross-jurisdictional law enforcement cooperation was not possible, although your device was monitored for at least one year to pursue any opportunity for collaboration between law enforcement agencies across country borders.

Recovery Efforts Unsuccessful

Investigation Report has been closed because recovery efforts have been unsuccessful over the course of at least one year from the date the theft was reported to us. This can be attributed to:

1. Insufficient evidence (for example, no records from an Internet Service Provider)
2. Unsuccessful searches
3. Suspension of the case by law enforcement
4. Other challenges related to obtaining actionable evidence and the overall involvement of law enforcement.

Insufficient Device Contact

Investigation Report has been closed because the device has contacted our Monitoring Center 3 times or less in the year since the theft was reported to us. In such situations, we have insufficient evidence to assist law enforcement in recovering the device. The device may have been connected to the Internet only once or twice to determine if it was working, after which:

1. The device was simply destroyed or dismantled for parts.
2. The device was used without ever connecting it to the Internet.
3. The hard drive was swapped or reformatted. On many modern models from large manufacturers, our software is embedded in the BIOS and will reinstall itself after the hard drive is swapped or reformatted. However, if the agent software is NOT embedded in the BIOS, the agent software may not survive reformatting of the hard drive and the device will be unable to contact the Monitoring Center.

Machine Outside Jurisdiction

Investigation Report has been closed because the device is contacting our Monitoring Center from a different country than the country of theft, and regional law enforcement restrictions prevent recovery of the device. We will pursue collaboration opportunities between law enforcement agencies wherever possible.

Unrecoverable Territory

Investigation Report has been closed because the device was stolen and/or is located in a country which prevents its recovery, for any of the following reasons:

1. The culture, customs and actual governance are not aligned with the rule of law in general, and laws concerning property theft in particular,
2. The governmental resources are insufficient to enforce the laws,
3. The infrastructure of the region or country impedes transmission of the data required for tracking and recovery purposes,
4. Tracking and investigating activities are prohibited by the laws of that region or country, and
5. In the case of the device moving between multiple jurisdictions, those jurisdictions may have policing bodies that do not collaborate in the enforcement of their respective property laws.

In these situations we monitor the Investigation Report for a minimum of one year for any changes that may enable us to pursue the recovery.

Civil Case

Investigation Report has been closed because the outcome involves legal issues between individuals or organizations in situations other than criminal matters, sometimes involving family law disputes. We cannot work with law enforcement to pursue an assisted recovery as they are not authorized to act on civil matters. Civil cases usually involve private property rights such as lawsuits involving breach of contract, probate or divorce.

Incomplete Investigation Report

Investigation Report has been closed because critical information needed to pursue an investigation is missing and several attempts to receive this information from you have been unsuccessful.

Software not Installed

Investigation Report has been closed because our software was never completely installed and activated on the device. Therefore, no recovery is possible. It is not possible to install and activate the software once the device is no longer in your possession.

Note: If you have additional devices with our software, please refer to the information provided with the software subscription or contact Technical Support to be sure these devices are activated. Full contact details can be found at www.absolute.com/support.

No Post Theft Contact

Investigation Report has been closed because the device did not contact our Monitoring Center after the theft was reported to us, although the device was monitored for at least one year.

Here are some reasons why a device may never contact our Monitoring Center:

1. It was destroyed or dismantled for parts.
2. The device was be used without ever connecting it to the Internet.
3. The hard drive was swapped or reformatted. On many modern machines from large OEM manufacturers, our software is embedded in the BIOS and will reinstall itself after the hard drive is swapped or reformatted. However, if the agent software is NOT embedded in the BIOS, the agent software may not survive reformatting of the hard drive and the device will be unable to contact the Monitoring Center.

Perpetual Delete Deployed by Customer

Investigation Report has been closed because you have requested a perpetual data delete operation, which renders the device unusable and prevents it from contacting our Monitoring Center. No device recovery is possible.

Customer Requested Closure

Investigation Report has been closed upon your request.

Police Recovered

Investigation Report has been closed because we have received an update from you or from law enforcement informing us that the device has been recovered. Used when our software and/or services have not contributed to the outcome. For example, law enforcement have located the device and returned it to you before the device contacted our Monitoring Center.

Duplicate

Investigation Report has been closed because we received more than one investigation report for the same device.

Cancelled

Investigation Report has been closed because the wrong device was reported stolen, the device has been found (was lost, not stolen), or the Investigation Report was for evaluation purposes only.