Remote Viewing

• A remote viewing tool is the only way a network administrator can literally see what a remote computer is doing. It allows a network administrator or computer technician to see what you are doing as a real-time image and displays in a window on the network administrator's console. You may notice a remote viewing tool active on your computer because a particular icon or warning displays on your screen; however, not all remote viewing tools are visible to you as an end user.
  
  

Network Monitoring

• Network monitoring tools allow a network administrator to view statistics and details about the traffic in her network. Monitoring tools may be used in real-time or may log data for future review. These monitoring tools can give a network administrator a variety of information, including what types of data traffic are present in the network, when an unusually large amount of throughput (data that is going someplace) is present and what web pages are being accessed. Additionally, network monitoring tools may tell a network administrator exactly what computer suspicious traffic originated from.
  
  

Inspecting Files

• A network administrator or computer technician may inspect the actual files on a given computer for traces of suspicious activity. This kind of investigation is usually triggered by a problem or suspect behavior reported on the computer, either by an end user or by someone who saw something suspicious on that end user's screen. Files may be investigated physically at the computer or via remote access without the end user's being aware of the investigation. Suspicious files and traces of suspicious activity may be found in half a dozen locations on your hard drive. Certain actions also leave timestamps visible in the file structure or through the operating system, and those timestamps can be used to determine who was logged in when the actions were taken.