The laptop left on a train
A laptop was reported lost an hour and a half after it was left behind. Check encryption, then look for sign-ins from the device after the loss but before the remote lock.
Briefing
A user left a laptop on a train at about 18:15 UTC and reported it at 19:40. The service desk locked it remotely at 20:14.
Full-disk encryption protects a powered-off laptop. A laptop that was asleep and signed in is a different case: any session still open is the risk. Check both.
ir-ws · Incident timelines
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.