Software Evaluation:
Winvestigator

Spying Made Easy

Winvestigator is a software product available from Tropical Software (http://www.tropsoft.com). Tropical Software offers several privacy and security products, ranging from PC file and access products to encryption products for files of all types. Even on its homepage, Tropical Software makes no bones about the purpose of Winvestigator:

Secretly monitor and record user activities with this easy-to-use investigative software.

The idea behind Winvestigator is simple. Essentially, it lets you look over the shoulder of anyone using your computer and watch what they type, which programs they run, which Web sites they visit, and so on. Relatively cheap at $39.95, Winvestigator is designed for a standalone installation on a PC running most any of the Microsoft Windows operating systems. The Web site emphasizes how easy the software is to use, in part due to its browser-based interface, and the marketing message seems aimed at consumers, such as parents who are concerned about what their kids are accessing online or spouses who are suspicious of their partners' habits. While businesses could also take advantage of this software to monitor their employees, the lack of management applications or other tools for the analysis of multiple streams of data testify to its modest scope.

Getting Started

Installing Winvestigator was a straightforward and (especially in software terms) painless process. The installation is little more than accepting their license agreement and selecting an installation directory. However, an additional panel during the install clues the user in to the nature of the program:

Right away you get to decide how sneaky you want to be. [Note: It's a small thing, but a typo in a software product always makes me worry about the attention to detail given to it by the development team; "Hidden Instalation" was the first of several typos I came across in the interface and the documentation.]

After installation, you start the Winvestigator HTML-based interface (Internet Explorer 5 and up required), as shown below.

From here, you can specify the settings that are in effect when Winvestigator is running. All specified activity is saved to a log file, which you can also view through the Winvestigator interface. The basic features include:

• Logging a user's keystrokes, including function keys, and sign-ins
• Logging which programs are used. The executable name is logged, along with when the program was started and stopped.
• Logging the Web sites a user visits. For each Web page that the user accesses, the URL is written to the log, and since the log file is an HTML file, you can follow any URLs you might be curious about.
• Automatic screen captures taken according to various criteria of your choosing, such as image quality. You can select a full screen capture or just the selected window and specify how often you want to take captures. You can even take a screen capture each time the mouse is clicked.
• Displaying a warning message when a user logs on, telling the user that they are being monitored (although you can set the text of this message to say anything you like).
• Encrypting the log file and specifying other settings for the log file, such as its size and location.

Okay, But Does It Work?

Actually, it does. Granted, this isn't rocket science, but it pretty much seems to do what it claims. After setting myself up for full monitoring, I restarted the machine and, sure enough, got the warning message:

Then I put it through a few paces designed to hit all the areas it was supposed to be watching. This included logging into the Oracle server at SILS, browsing a few pages on the Web, and using AOL's online chat system. I opened the Winvestigator interface again and looked through the log. The figure below is an example of what the log contains:

Winvestigator also snapped a small capture when I clicked on the link to check out Cisco's recent earnings report:

As I went through the log, I could indeed see each program I used, the keys I hit, and the Web sites I surfed. The periodic screen captures provide a visual trail of breadcrumbs that augmented the textual information in the log.

When Should You Use It?

From a technical standpoint, the product can be used in several different environments:

• For home use, Winvestigator lets you monitor not only what your teenage son is viewing online,
  
  but also exactly what he's saying in his chat rooms. Granted my chat test was only with myself and you only get one side of the conversation, but every word I entered was captured, and that glimpse is more than most parents can ever expect to get.
• If you find yourself spending a lot of time online and need the ability to recall your surfing history (without bookmarking everything along the way), you could turn Winvestigator on selectively purely as a history mechanism.
• Likewise Winvestigator could be used as part of a low-budget usability testing process, for those situations where you are interested in a subject's navigation patterns and browsing strategies.

However, just because Winvestigator might be useful doesn't mean there aren't concerns involved. The most obvious question is that of privacy -- is it ethical to use monitoring software in the first place, particularly if you can hide the presence of the software? Similarly, what about misappropriation? When I accessed my Oracle account at SILS, the user ID and password I typed into the SQL*Plus application were dutifully logged, along with my SQL queries and so on. I can easily envision someone installing Winvestigator on a machine and then letting it run, gathering user IDs, passwords, and other sensitive data. All that remains is some means of accessing Winvestigator remotely, and you've got a nice way of "tapping" an unsuspecting user's machine.

So, all in all, Winvestigator does its job, and there are several ways it can make itself useful. Still, as soon as I'm finished with this evaluation, I'm going to uninstall it. After all, I really don't want to know what my wife says about me when she's chatting online with her mother.

<< Back to INLS187 page